Barracuda Email Security Gateway flaws allow unauthenticated root access

Security researchers have identified a critical vulnerability chain in Barracuda’s Email Security Gateway that allows attackers to gain root-level access without authenticating. Barracuda released patches for the issue on Monday, November 3, 2026, while the security firm watchTowr published a detailed technical analysis of the exploit chain on Thursday, November 6, 2026.

What happened

The vulnerability involves two distinct flaws that, when combined, bypass all authentication mechanisms. The first flaw, tracked as CVE-2026-116606, is an authorization bypass specific to the Email Security Gateway. It allows an unauthenticated attacker to restore a crafted configuration backup, thereby altering global settings on the appliance. The second flaw, CVE-2026-111560, is a command injection vulnerability that executes commands with root privileges. While this second flaw typically requires administrator credentials, the authorization bypass provides the necessary access level to trigger it remotely.

Mandiant assigned severity scores of 9.3 out of 10 for the authorization bypass and 8.6 out of 10 for the command injection. Although the command injection affects five other Barracuda products, those variants still require valid administrator accounts, limiting their immediate risk compared to the gateway-specific chain. Barracuda has issued fixed firmware for all affected products, with the Email Security Gateway requiring version 9.4.0.030 or later to resolve both issues.

Key details

• CVE-2026-116606: An authorization bypass allowing unauthenticated backup restoration and setting changes on the Email Security Gateway.
• CVE-2026-111560: A command injection flaw that runs commands as root, exploitable via the bypass on the gateway.
• Fixed version: Email Security Gateway users must upgrade to firmware version 9.4.0.030 or later.
• Attack vector: Attackers forge a backup checksum using a hard-coded secret, then inject malicious commands via the timezone setting.
• Current status: No public reports link these flaws to active attacks, and they are not yet in CISA’s Known Exploited Vulnerabilities catalog.
• Detection: watchTowr released a tool to check for vulnerability but has not published an exploit code.

Background

To understand the severity, it helps to look at how the attack chain functions technically. WatchTowr’s analysis reveals that a failed password change request does not properly terminate the session. Instead, it assigns the user a low-privilege role that inadvertently leaves the backup-restore function accessible. This function accepts uploaded configuration files. Normally, these files are protected by a checksum to ensure integrity. However, because the secret key used to generate this checksum is embedded directly in the source code, an attacker can calculate a valid checksum for a malicious file.

Once the forged backup is restored, the appliance processes the configuration data. Specifically, it takes a timezone value from the backup and executes it as a shell command with root privileges. By embedding a malicious command in the timezone field of the crafted backup, an attacker achieves remote code execution with the highest possible permissions on the device. This type of vulnerability is particularly dangerous for email gateways, which sit at the perimeter of corporate networks and handle sensitive communication traffic.

Why it matters

For teams managing their own infrastructure, this incident highlights the risks associated with complex, closed-source appliances. The reliance on a hard-coded secret for checksum validation represents a fundamental design failure. When secrets are embedded in code rather than managed dynamically, any party with access to the binary can reverse-engineer them. This undermines the integrity checks meant to protect configuration backups, turning a safety feature into an attack vector. For IT leads, this underscores the importance of scrutinizing how vendors handle cryptographic secrets and configuration management.

Furthermore, the chaining of two moderate-severity flaws into a critical exploit demonstrates why holistic security testing is essential. Individually, an authorization bypass and a command injection might be rated lower if they required partial access. Together, they create a zero-authentication path to root. This scenario is a reminder that security assessments must consider how different components interact. Teams running self-hosted software should regularly review vendor advisories not just for single vulnerabilities, but for potential chains that could escalate privileges unexpectedly.

What you can do

• Upgrade immediately: Apply the latest firmware (version 9.4.0.030 or later) to all Barracuda Email Security Gateways.
• Restrict network access: If immediate patching is not possible, limit access to the administration interface to trusted internal IP addresses only.
• Enable automatic updates: Ensure automatic patching is enabled to reduce the window of exposure for future vulnerabilities.
• Run detection tools: Use the detection tool released by watchTowr to verify if your appliances are currently vulnerable.
• Audit logs: Review system logs for unusual backup restoration activities or failed password change attempts from external IPs.
• Monitor advisories: Subscribe to vendor security notifications and CISA alerts to stay informed about new threats.