Barracuda Email Security Gateway Flaws Allow Unauthenticated Root Access
Security researchers demonstrate an attack chain in Barracuda Email Security Gateway enabling unauthenticated root access.
Security firm watchTowr has detailed a dangerous attack chain affecting Barracuda's Email Security Gateway, an email-filtering appliance. Two flaws can be combined to execute commands with root privileges without requiring any login.
The vendor released security patches on Monday to address the issues, while the research details regarding the exploit chain were published on Thursday.
Technical Overview of the Flaws
One of the critical flaws, tracked as CVE-2026-116606, functions as an authorization bypass vulnerability. An unauthenticated attacker can leverage this flaw to restore functionality maliciously.
By chaining this authorization bypass with another vulnerability, malicious actors can achieve the highest level of access on the target appliance.
Read alsoBarracuda CVE-2026-116606 Flaws Let Attackers Gain Root AccessImpact on Enterprise Security
Administrators responsible for managing Barracuda email-filtering appliances are strongly urged to apply the official patches released by the company immediately to prevent potential system compromise.
Source: The Hacker News
