Two flaws in Barracuda’s Email Security Gateway can be combined to run commands without logging in, giving an attacker root access—the appliance’s highest level of control. The Hacker News reported that Barracuda released patches on Monday, and security firm watchTowr detailed the attack chain on Thursday.
Organizations running the email-filtering appliance should check their patch status: Email Security Gateway version 9.4.0.030 and later contains the fixes. One of the flaws also affects five other Barracuda products, although exploiting it on those products still requires an administrator account.
How the two flaws combine
CVE-2026-116606 is an authorization bypass, a failure to enforce access restrictions. It affects only Email Security Gateway and lets an unauthenticated attacker restore a specially crafted configuration backup, changing the appliance’s global settings.
The second flaw, CVE-2026-111560, is command injection: data supplied to the appliance can become operating-system commands. It runs those commands as root but normally requires administrator access. On Email Security Gateway, the authorization bypass provides the access needed to exploit it without a login.
Mandiant, which assigned the two CVE identifiers, rates the bypass at 9.3 out of 10 and the command injection at 8.6.
In its technical analysis, watchTowr traced the bypass to a failed password-change request. Instead of stopping the request, the code returns a low-privilege role, leaving a backup-restoration function accessible to someone who has not authenticated.
The uploaded backup can contain a timezone value that the appliance later executes as a shell command with root privileges. Backups have a checksum, a value used to check their integrity, but the secret used to calculate it is embedded in the code. That lets an attacker forge a valid checksum for a malicious backup. watchTowr demonstrated the chain by writing a file to the appliance as root.
The researchers also released a tool to check whether an appliance is vulnerable, but have not published an exploit. The Hacker News reported no public attacks tied to either flaw and said neither appeared in CISA’s Known Exploited Vulnerabilities catalog that week.
Email Security Gateway was previously targeted by UNC4841 in 2023 through a different vulnerability, CVE-2023-2868, before a fix was available. CISA’s catalog lists that older flaw; those attacks are unrelated to the newly disclosed pair.
What administrators should do
The Hacker News reports that Barracuda has released patches for every affected product, with product-specific fixed firmware listed in its security advisory. Administrators should apply the relevant patch or upgrade to the fixed firmware; for Email Security Gateway, that is 9.4.0.030 or later.
Barracuda’s advisory also recommends restricting the administration interface to trusted internal networks if immediate patching is not possible. Administrators who disabled automatic patching should turn it back on.
