Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

[Starburst-David]

Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required.

The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday.

One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a crafted configuration backup and change the appliance's global settings.

The other, CVE-2026-111560, is a command injection. It runs commands as root but normally needs an administrator account, and on the Email Security Gateway the bypass gives an attacker that access. Chained, the two let an attacker reach root with no login.


Full article at:
https://thehackernews.com/2026/11/exper ... email.html

Published Date: Nov 06, 2026

Vulnerabilities has been mentioned in this article.
CVE-2026-116606 CVE-2026-111560 CVE-2023-2868