cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Barracuda Email Security Gateway Flaws Can Be Chained for Unauthenticated Root Access

· Original article ↗

Summary

Researchers showed that CVE-2026-116606 and CVE-2026-111560 can be chained to gain unauthenticated root access to Barracuda Email Security Gateway appliances. Barracuda patched affected products; the ESG fix is firmware 9.4.0.030 or later.

Key points

  • watchTowr traced a chain in which an authorization bypass lets an unauthenticated attacker restore a crafted configuration backup and change appliance settings.
  • A restored timezone value is later executed as a shell command with root privileges; a secret embedded in the code lets attackers forge the backup checksum.
  • CVE-2026-111560 is a command-injection flaw that normally requires an administrator account; chaining it with CVE-2026-116606 removes that requirement on the Email Security Gateway.
  • The command-injection flaw affects five other Barracuda products, but those products still require an administrator account.
  • watchTowr demonstrated root access by writing a file to the appliance. It released a detection tool but has not published an exploit.
  • Barracuda released patches for affected products; Email Security Gateway firmware 9.4.0.030 and later is fixed. Neither flaw was listed in CISA's KEV catalog, and the article reports no public links to attacks.

Article Details

Vulnerability Types
  • Authorization bypass
  • Command injection
Severity
Mandiant rated the authorization bypass 9.3/10 and the command injection 8.6/10.
Exploitation Status
not_reported
Exploit Availability
none_reported
Patch Status
available

MITRE ATT&CK

T1059.004 · Unix ShellA restored timezone value is executed as a shell command with root privileges.T1068 · Exploitation for Privilege EscalationChaining the authorization bypass with command injection lets an unauthenticated attacker reach root access.

CVE

CVE-2026-111560Barracuda Networks · Barracuda Email Security Gateway (ESG); Barracuda Networks · Barracuda Load Balancer Application Delivery Controller (ADC); +4 moreThe other, CVE-2026-111560, is a command injection. It runs commands as root but normally needs an administrator account, and on the Email Security Gateway the bypass gives an attacker that access. Chained, the two letCVE-2026-116606Barracuda Networks · Barracuda Email Security Gateway (ESG)One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a crafted configuration backup and change the appliance's global settings.

Threat Actors

UNC4841The article says this group exploited a different Email Security Gateway flaw, CVE-2023-2868, in 2023; it states that incident is unrelated to the newly patched flaws.

Vendors

BarracudaTwo flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required.

Products

Email Security GatewayTwo flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required.

Related Articles