Ing. Calogero Bono
Barracuda has released patches for two vulnerabilities that, used together, allow a remote attacker to run commands as root on the Email Security Gateway without any login. Italy's CSIRT has issued an alert, pointing to the availability of a proof of concept (PoC). The company watchTowr has published the technical analysis of the chain. It matters because the appliance filters corporate email and, if exposed, becomes a very sensitive entry point.
A few terms before we get into the facts. CVE is the code that identifies a known vulnerability. PoC (Proof of Concept) is a demonstration that shows how to exploit a flaw. Authentication bypass means getting around access control. Command injection is inserting system commands into a field that should only contain data. CVSS is the severity score from 0 to 10.
What happened with Barracuda?
According to the ACN alert, a PoC is available for two flaws, CVE-2026-116606 and CVE-2026-111560, which affect several Barracuda products. Chained together, they allow a remote attacker who can reach the administrative interface to bypass authentication and execute arbitrary code.
As reported by The Hacker News, the company released patches on Monday and watchTowr detailed the chain on Thursday.
How do the two flaws work?
CVE-2026-116606 is an authentication bypass rated 9.3 out of 10 (CVSS 4.0). It affects only the Email Security Gateway. According to the ACN, it stems from an error in the administrative password change. When the change fails, the software reports the error but does not stop the request.
CVE-2026-111560 is a command injection rated 8.6. The time zone field (system_timezone) does not neutralize shell metacharacters, and commands run with elevated privileges. Normally an administrator account is required, but on the ESG the bypass grants it.
How does one get to root without logging in?
According to watchTowr's analysis, reported by The Hacker News, the failed password change gives the attacker a low-privilege role instead of blocking the request. This leaves a backup restore function open.
The uploaded backup contains a time zone value that the appliance then runs as a shell command with root permissions. Barracuda protects backups with a checksum, but the secret used to compute it is written into the code, so it can be forged. watchTowr demonstrated the attack by writing a file as root.
Which products are affected and how is it fixed?
The command injection affects six products.
- Email Security Gateway
- Load Balancer ADC
- Message Archiver
- WAF Control Center
- Web Application Firewall
- Web Security Gateway
On the five products other than the ESG, an administrator account is still required. Barracuda has a patch for each product. The Email Security Gateway is fixed from version 9.4.0.030 onward. If you cannot update right away, limit the administrative interface to trusted internal networks and re-enable automatic updates if you had turned them off.
Limits to know
Neither flaw appears in CISA's KEV catalog, and no public report links them to an attack. watchTowr has released a detection tool but not an exploit. It remains to be seen whether public exploits will appear. The two sources describe the bypass slightly differently, and the full list of affected versions only appears in the vendor's bulletin.
What changes for those working in digital
If your company uses a Barracuda appliance, check the firmware version right away and apply the patch. Then verify whether the administrative interface is reachable from the internet, since that is the requirement for the attack. If you manage your own infrastructure, you can restrict access the way you would with a private subnet and security groups. If you entrust your servers to third parties, ask who handles updates, as with managed hosting.
Our take
This case shows a classic mistake. A check that flags the problem but does not stop the process is worth little. On top of that, a fixed secret hardcoded in the checksum code stops no one. A perimeter defense should never open remote root access. Also remember the APT flaw with installations running as root. No need to panic, but the patch should be applied now.
Frequently asked questions
Does exploiting the Barracuda ESG chain require a login?
No. According to The Hacker News, the two chained flaws lead to root with no login. However, the attacker must still reach the appliance's administrative interface.
Which Email Security Gateway versions are fixed?
Version 9.4.0.030 and later. Details for each product are in Barracuda's security bulletin.
Are the flaws already being exploited in attacks?
There is no evidence of that. The sources say they are not in CISA's KEV catalog and that no public report links them to an attack. A PoC, however, is available.
What should I do if I cannot update right away?
Limit the administrative interface to trusted internal networks. Also re-enable automatic updates if you had turned them off.
Who assigned the two CVEs?
Mandiant, according to The Hacker News. Mandiant, which assigned the two CVEs, rated the bypass 9.3 out of 10 and the command injection 8.6.
What to watch in the coming weeks on Barracuda appliances
The patch is out, but the PoC is available and the window between disclosure and attacks is shrinking. It is worth following how this develops.
- Check whether the two CVEs enter CISA's KEV catalog or whether public exploits appear.
- Use watchTowr's detection tool to check your appliances.
- Re-read Barracuda's bulletin for products other than the ESG and confirm the correct versions.
