Barracuda patches gateway chain that grants unauthenticated root access
Two Barracuda flaws can be chained for root access
Barracuda has released patches for two vulnerabilities in its Email Security Gateway that researchers say can be chained to run commands as root without requiring a login. The affected appliance is fixed in firmware version 9.4.0.030 and later.
The vulnerabilities are CVE-2026-116606, an authorization bypass affecting the Email Security Gateway, and CVE-2026-111560, a command-injection issue. Mandiant assigned the CVE records and rated the flaws 9.3 and 8.6 out of 10 respectively.
On its own, the command injection affects five additional Barracuda products but requires an administrator account on those products. On the Email Security Gateway, the authorization bypass can provide the access needed to reach the command-injection path, creating an unauthenticated route to root-level command execution.
Backup restoration provides the path into the appliance
Security firm watchTowr traced the chain through the appliance code. A failed password-change request returns a low-privilege role instead of stopping the request entirely. That state leaves a backup-restore function accessible to a party that has not authenticated.
An attacker can upload a crafted configuration backup through that function and change the appliance's global settings. The restored data includes a timezone value that the appliance subsequently executes as a shell command with root privileges, watchTowr said.
Barracuda protects backup files with a checksum, but watchTowr found that the secret used to calculate it is embedded in the code. An attacker can therefore generate a checksum that the appliance accepts for a malicious backup. The researchers demonstrated the chain by writing a file to the appliance as root.
Patch or restrict administrative exposure
Barracuda's advisory calls for applying the available patch for every affected product or upgrading to the listed fixed firmware. For the Email Security Gateway, organizations should move to version 9.4.0.030 or later.
Where immediate patching is not possible, Barracuda recommends limiting the appliance's administration interface to trusted internal networks. Organizations that disabled automatic patching should enable it again.
Neither vulnerability appears in CISA's Known Exploited Vulnerabilities catalog, and no public reporting has linked the pair to attacks. watchTowr has released a detection tool to identify vulnerable appliances but has not published an exploit. The issue is separate from the 2023 Barracuda Email Security Gateway attacks attributed to the group tracked as UNC4841, which exploited CVE-2023-2868.
For security teams, the practical priority is to identify every affected Barracuda appliance, confirm its firmware level, apply the relevant fix, and keep administrative interfaces reachable only from trusted networks until remediation is complete.