Barracuda Patches Critical Chain Granting Unauthenticated Root Access on Email Security Gateway

Key points

• Barracuda disclosed two vulnerabilities, CVE-2026-116606 and CVE-2026-111560, affecting multiple products including the Email Security Gateway, Load Balancer ADC, and Web Application Firewall.
• CVE-2026-116606 is a pre-authentication authorization bypass with a CVSS score of 9.3, while CVE-2026-111560 is a command injection vulnerability with a CVSS score of 8.6.
• According to watchTowr Labs, the authorization bypass occurs when a failed password change request returns a low-privilege role instead of terminating the session, allowing access to backup restore functions.
• The command injection flaw exists in the backup restore process, where a manipulated timezone value is executed via a shell command as root.
• Barracuda advises customers to apply patches immediately, restrict administrative interfaces to trusted networks, and verify that firmware is up to date, as multiple updates may be required for older versions.

Background

Barracuda’s Email Security Gateway has previously been targeted by zero-day exploits, such as CVE-2023-2868, which required physical replacement of compromised appliances. Security experts have noted that security appliances, including firewalls and email gateways, are often exposed to the internet by design and hold sensitive credentials, making them high-value targets for attackers. The current vulnerabilities highlight the ongoing risk of exposed administrative interfaces and the importance of robust access controls and timely patching.

How outlets are covering it

watchTowr Labs provided a detailed technical analysis of the attack chain, explaining how the authorization bypass and command injection vulnerabilities can be combined to achieve root access. The Hacker News and CSO Online reported on the vulnerabilities and Barracuda’s advisory, emphasizing the need to restrict administrative interface access and apply patches. Frank Dickson of Dickson Research highlighted the risk of root access on an email gateway, noting that it could expose credentials and connections to mail servers and directories. Jon Nelson of Infotech warned that exposing administrative interfaces to the internet is a significant risk, especially as AI makes it easier to find and chain vulnerabilities. Barracuda’s advisory noted that organizations with administrative interfaces not exposed to the internet are less vulnerable, but it did not specify whether the vulnerabilities are currently being exploited.

Why it matters

The vulnerabilities pose a significant risk to organizations using Barracuda’s security appliances, as they can lead to unauthenticated root access and potential compromise of sensitive data. The attack chain demonstrates the importance of robust access controls and timely patching, especially for devices exposed to the internet. Organizations should review their administrative interface exposure and ensure that their systems are up to date with the latest firmware to mitigate the risk of exploitation.

What to watch

Barracuda has released patches for the vulnerabilities, and customers are advised to apply them immediately. Organizations should also restrict administrative interface access to trusted internal networks and verify that their systems are running the latest firmware. Security experts recommend reviewing administrative logs for unauthorized access and checking for unfamiliar accounts or unexpected outbound connections. As AI continues to expand the search for software flaws, organizations should prepare for more vulnerability disclosures and shorter response windows by identifying exposed appliances and having a response plan ready.