Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login Swati KhandelwalNov 06, 2026Vulnerability / Email Security Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a crafted configuration backup and change the appliance's global settings. The other, CVE-2026-111560, is a command injection. It runs commands as root but normally needs an administrator account, and on the Email Security Gateway the bypass gives an attacker that access. Chained, the two let an attacker reach root with no login. The authorization bypass affects only the Email Security Gateway. The command injection reaches five other products, but on those it still needs an administrator account. Mandiant, which assigned the two CVE records, rates the bypass 9.3 out of 10 and the command injection 8.6. Barracuda has released a patch for each affected product and lists the fixed firmware in its security advisory. The Email Security Gateway is fixed in version 9.4.0.030 and later. Apply the patch for each affected product, or upgrade to the fixed firmware listed above. If you cannot patch at once, limit the appliance's administration interface to trusted internal networks. If you have turned automatic patching off, switch it back on. In its technical analysis, watchTowr traced the chain through the appliance's code. A failed password change returns the attacker a low-privilege role instead of stopping the request, which leaves a backup-restore function open to someone who has not logged in. That function accepts an uploaded backup, and the restored data includes a timezone value that the appliance later runs as a shell command with root privileges. Barracuda guards backups with a checksum, but the secret used to compute it is built into the code, allowing an attacker to forge a valid checksum. The firm showed the attack by writing a file to the appliance as root. As of this week, neither flaw appears in CISA's Known Exploited Vulnerabilities (KEV catalog), and no public report ties either to an attack. watchTowr also released a detection tool that checks whether an appliance is vulnerable, but has not published an exploit. The Email Security Gateway was hit in the 2023 attacks by a group tracked as UNC4841, which exploited a different flaw, CVE-2023-2868, as a zero-day. That case is unrelated to the two flaws patched this week, and nothing ties the new pair to any attacker. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. email security, network security, remote code execution, Vulnerability CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed AI-Generated Fake Login Pages Are Making Account Takeovers Easier PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Session Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. ROI Calculator: See the Value of IAM Automation Calculate your savings on audits, app onboarding, and discovery. Try it now. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Your Attack Surface Is Growing Faster Than Your Team Can Respond Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security