Ethical Hacking News
A critical vulnerability in Barracuda's Email Security Gateway has been discovered, allowing attackers to gain root access without logging in. The vulnerability, identified as CVE-2026-116606 and CVE-2026-111560, can be chained together to grant an attacker root access to the appliance. To mitigate the vulnerability, Barracuda has released patches for the affected products, and experts recommend applying the patches as soon as possible to ensure the security of the appliance.
There is a critical vulnerability in Barracuda's Email Security Gateway that can grant an attacker root access without a login. The vulnerability, identified as CVE-2026-116606 and CVE-2026-111560, can be chained together to achieve the desired outcome. The first flaw, CVE-2026-116606, is an authorization bypass that allows an unauthenticated attacker to restore a crafted configuration backup. The second flaw, CVE-2026-111560, is a command injection vulnerability that allows an attacker to run commands as root without an administrator account. Barracuda has released patches for the affected products and urges customers to apply them as soon as possible. The incident highlights the importance of keeping software up to date and applying patches in a timely manner.
The cybersecurity world has been left reeling by the recent revelation of a critical vulnerability in Barracuda's Email Security Gateway, an email-filtering appliance designed to protect organizations from malicious threats. The vulnerability, identified as CVE-2026-116606 and CVE-2026-111560, can be chained together to grant an attacker root access to the appliance without the need for a login. This is a serious concern, as it allows attackers to potentially manipulate or disrupt the email security measures in place.
According to experts at watchTowr, a security firm that detailed the attack chain, the two flaws can be combined to achieve the desired outcome. The first flaw, CVE-2026-116606, is an authorization bypass that allows an unauthenticated attacker to restore a crafted configuration backup and change the appliance's global settings. This bypass grants the attacker access to sensitive areas of the appliance, which is normally restricted.
The second flaw, CVE-2026-111560, is a command injection vulnerability that allows an attacker to run commands as root, even without an administrator account. When chained with the authorization bypass, this vulnerability allows an attacker to access the appliance's root level of access without needing to log in.
Researchers at watchTowr traced the chain through the appliance's code, revealing that a failed password change returns the attacker a low-privilege role instead of stopping the request, leaving a backup-restore function open to someone who has not logged in. This function accepts an uploaded backup, and the restored data includes a timezone value that the appliance later runs as a shell command with root privileges. Barracuda guards backups with a checksum, but the secret used to compute it is built into the code, allowing an attacker to forge a valid checksum.
The experts also showed the attack by writing a file to the appliance as root, demonstrating the potential for an attacker to gain unauthorized access. As of this week, neither flaw appears in CISA's Known Exploited Vulnerabilities (KEV catalog), and no public report ties either to an attack. However, watchTowr has released a detection tool that checks whether an appliance is vulnerable, but has not published an exploit.
The affected products and fixes have been listed, with the Email Security Gateway being fixed in version 9.4.0.030 and later. The advisory sets out three steps to mitigate the vulnerability: applying the patch for each affected product, or upgrading to the fixed firmware listed above; limiting the appliance's administration interface to trusted internal networks; and switching automatic patching back on.
In a statement, Barracuda has acknowledged the vulnerability and released patches for the affected products. The company's statement reads, "We take the security of our products very seriously and have released patches for the vulnerabilities identified by watchTowr. We urge all customers to apply the patches as soon as possible to ensure the security of their Barracuda Email Security Gateway appliances."
The incident highlights the importance of keeping software up to date and applying patches in a timely manner. It also underscores the need for organizations to regularly review and assess their email security measures to ensure they are effective in protecting against malicious threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Chain-Reaction-Barracuda-Email-Security-Gateway-Vulnerabilities-Expose-Root-Access-Without-Login-ehn.shtml
https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html
https://nvd.nist.gov/vuln/detail/CVE-2026-116606
https://www.cvedetails.com/cve/CVE-2026-116606/
https://nvd.nist.gov/vuln/detail/CVE-2026-111560
https://www.cvedetails.com/cve/CVE-2026-111560/
Published: Fri Nov 6 02:22:00 2026 by llama3.2 3B Q4_K_M
