A pair of serious vulnerabilities has been identified in Barracuda’s Email Security Gateway appliance—both flaws can be chained together to allow an attacker full root access without ever logging in.
What’s going on
The first flaw, CVE-2026-116606, is an authorization bypass in the Barracuda Email Security Gateway. It lets anyone—without authentication—restore a specially crafted configuration backup and alter critical global settings. The second, CVE-2026-111560, is a command injection issue: normally it requires admin rights, but when chained with the bypass it too can be triggered by an unauthenticated attacker, granting execution as root.
Scope of the impact
The authorization bypass is specific to the Email Security Gateway. The command injection vulnerability exists in five additional Barracuda products—but in those, it still requires admin credentials. Barracuda has released patches for all affected devices. The Email Security Gateway is fixed in firmware version 9.4.0.030 and newer. Both have been scored highly in severity by Mandiant: 9.3/10 for the bypass, 8.6/10 for the command injection.
How the attack chain works
Security researchers from watchTowr mapped out how the weaknesses interact. First, a failed password change triggers a fallback that assigns a low-privilege role rather than rejecting the change outright. That leaves a backup-restore function exposed, even to unauthenticated users. The restore accepts a backup including a timezone value. That value, later processed, gets passed unsanitized into a root-level shell command. Although backups are protected by a checksum, the secret key used to compute it is hardcoded—so attackers can forge valid checksums and upload malicious backups.
Mitigation & status
Barracuda has issued fixed firmware for every compromised product. Additionally, users are urged to narrow access to the administration interface—restrict it to trusted internal networks—and to re-enable automatic patching if they had disabled it. As of now, neither vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, and there are no confirmed reports of these being used in active attacks. WatchTowr also released a detection tool to scan for vulnerable units, though no live exploits have been published.
These gateway devices were previously targeted in 2023 in attacks linked to UNC4841—this time using a different vulnerability (CVE-2023-2868). There’s no evidence linking that earlier exploit to the new flaws.
What this means: These chained bugs amount to a serious remote code execution risk in products meant to guard email infrastructure. Organizations running Barracuda appliances should treat this as high urgency—patching, isolating admin interfaces, and scanning for exposure are essential. Moving forward, vendors must avoid hard-coding secrets and ensure backup/restore functions and privilege fallbacks are secure against unauthorized actors. Watch for further disclosure of exploitation attempts or related threats.
