Your Questions on the Barracuda Email Gateway Flaws That Chain to Root Without a Login, Answered
Two newly patched Barracuda Email Security Gateway flaws can be chained for unauthenticated root command execution. Here is what was fixed, which products are in scope, and what appliance owners should do.
Email security appliances sit at a privileged spot on the network. This week’s Barracuda patches are a reminder that the box filtering your mail can itself become the foothold. Researchers showed how two flaws chain to root access with no login on the Email Security Gateway.
Our Q&A is based on The Hacker News report of Barracuda’s Monday patches and watchTowr’s Thursday technical breakdown (CVEs assigned via Mandiant).
Q&A
1. What are the two flaws?
CVE-2026-116606 is an authorization bypass on the Email Security Gateway: an unauthenticated attacker can restore a crafted configuration backup and change global settings. CVE-2026-111560 is a command injection that runs as root but normally needs an administrator account. On the Email Security Gateway, the bypass supplies that access. Chained, they yield root with no login.
2. How bad are the scores?
Mandiant rates the bypass 9.3 out of 10 and the command injection 8.6.
3. Which products need attention?
The authorization bypass is specific to the Email Security Gateway. The command injection also reaches five other Barracuda products, but on those it still requires an administrator account. Barracuda lists fixed firmware in its advisory; the Email Security Gateway is fixed in version 9.4.0.030 and later.
4. How does the chain work, in plain language?
watchTowr found that a failed password-change path returns a low-privilege role instead of stopping the request, which leaves a backup-restore function open to someone who never logged in. The restored backup can include a timezone value that the appliance later runs as a root shell command. Backups are checksum-protected, but the secret used to compute the checksum is built into the code, so an attacker can forge a valid checksum. watchTowr demonstrated writing a file as root; it released a detection helper and did not publish an exploit.
5. Is this the same as the 2023 Barracuda ESG attacks?
No. The 2023 UNC4841 case abused a different flaw (CVE-2023-2868). Coverage does not tie the new pair to any active attacker campaign.
6. Are these in CISA’s Known Exploited Vulnerabilities list?
As of the reporting we used this week, neither CVE was listed in KEV, and no public report tied either to in-the-wild exploitation.
7. What should owners do first?
- Apply Barracuda’s patch or move to the fixed firmware for each affected product (ESG 9.4.0.030 or later for the gateway).
- If you cannot patch immediately, restrict the administration interface to trusted internal networks only.
- If automatic patching was turned off, turn it back on.
8. What should we watch after patching?
Confirm the admin interface is not exposed to the internet, review recent configuration-restore events, and treat any unexpected root-level changes on the appliance as a compromise signal.
What this means for your company
Mail gateways are easy to forget once they are “just working.” Unauthenticated admin paths and forged backups turn that quiet appliance into a high-value target. Keep email security firmware on the same urgency track as firewalls, lock management interfaces to admin networks, and verify automatic updates are actually enabled.
Not sure which Barracuda (or other email security) appliances you still run, what firmware they are on, or who can reach their admin pages? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
