Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required.

The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday.

One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a crafted configuration backup and change the appliance's global settings.

The other, CVE-2026-111560, is a command injection. It runs commands as root but normally needs an administrator account, and on the Email Security Gateway the bypass gives an attacker that access. Chained, the two let an attacker reach root with no login.

The authorization bypass affects only the Email Security Gateway. The command injection reaches five other products, but on those it still needs an administrator account.

Mandiant, which assigned the two CVE records, rates the bypass 9.3 out of 10 and the command injection 8.6. Barracuda has released a patch for each affected product and lists the fixed firmware in its security advisory. The Email Security Gateway is fixed in version 9.4.0.030 and later.

In its technical analysis, watchTowr traced the chain through the appliance's code. A failed password change returns the attacker a low-privilege role instead of stopping the request, which leaves a backup-restore function open to someone who has not logged in.

That function accepts an uploaded backup, and the restored data includes a timezone value that the appliance later runs as a shell command with root privileges.

Source link