# Barracuda Email Security Gateway Vulnerabilities Enable Unauthenticated Root Access Two chained flaws allow attackers to bypass authentication and execute commands as root. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-11-06 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/d7e2f1b5-1ca8-4f22-8b6f-75bea9a5d105 ## Critical Authentication Bypass Two distinct vulnerabilities in Barracuda's Email Security Gateway allow unauthenticated attackers to gain root access. The first flaw, CVE-2026-116606, functions as an authorization bypass. By exploiting this, unauthorized users can restore crafted configuration backups. This process effectively overrides global appliance settings without requiring any valid administrative login credentials. ## Command Injection Mechanism The second vulnerability, CVE-2026-111560, is a command injection flaw. While this typically requires administrative privileges, the authorization bypass grants the necessary access level. When chained together, these vulnerabilities allow an attacker to execute arbitrary commands with root privileges, which represents the highest level of system control available. ## Technical Attack Chain Analysis by watchTowr reveals that a failed password change incorrectly grants low-privilege roles instead of blocking requests. This exposes a backup-restore function to unauthenticated users. Although Barracuda protects backups with checksums, the secret key is hardcoded within the firmware, enabling attackers to forge valid checksums and bypass security integrity checks. ## Severity and Impact Mandiant assigned high severity scores to these flaws, rating the authorization bypass at 9.3 and the command injection at 8.6 out of 10. While the bypass affects only the Email Security Gateway, the command injection vulnerability impacts five additional Barracuda products, though those require administrator accounts for successful exploitation. ## Patching and Remediation Barracuda released security patches this Monday to address both vulnerabilities across affected products. For the Email Security Gateway, users must update to firmware version 9.4.0.030 or later to mitigate these risks. The company has published a detailed security advisory listing all specific firmware versions that contain the necessary fixes. ## Current Threat Landscape As of this week, neither vulnerability appears in the CISA Known Exploited Vulnerabilities catalog. There are currently no public reports linking these specific flaws to active exploitation attempts. While watchTowr released a detection tool to help administrators identify vulnerable appliances, they have not published a functional exploit for these issues. ## Historical Context This incident follows a 2023 security event where the group UNC4841 exploited a different zero-day vulnerability, CVE-2023-2868, within the same Email Security Gateway product. However, current technical analysis confirms that the newly discovered flaws are entirely unrelated to that previous campaign and no evidence suggests a connection to any specific threat actor. ## Security Recommendations Organizations utilizing Barracuda appliances should prioritize firmware updates immediately to close these identity and access gaps. Security teams should utilize the provided detection tools to verify their current exposure levels. Maintaining visibility across machine identities and monitoring for unauthorized configuration changes remains essential for defending against these types of appliance-level vulnerabilities. ## Sources covering this story - [The Hacker News — Barracuda Email Security Gateway Vulnerabilities Allow Root Access Without Login](https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html) - [Technical Information Security Content & Discussion — Critical RCE Vulnerabilities Found in Barracuda Email Security Gateways](https://www.reddit.com/r/netsec/comments/1xouqpj/barracuda_networks_is_your_new_best_friend/) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._