Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

Researchers at watchTowr have shown how two separate bugs in Barracuda's Email Security Gateway can be combined to give an outsider full root control without ever logging in. The first flaw, CVE-2026-116606, lets an unauthenticated attacker abuse a broken authorization check tied to failed password changes, gaining enough access to restore a forged configuration backup. The second, CVE-2026-111560, is a command-injection bug that normally requires admin credentials but, once chained with the first flaw, executes attacker-controlled shell commands as root via a timezone field hidden in that backup. Mandiant, which issued the CVEs, scored them 9.3 and 8.6 respectively; the command-injection bug also affects five other Barracuda products, though only with existing admin access. Barracuda shipped fixes for all affected products on Monday — the Email Security Gateway is patched in version 9.4.0.030 and later — and recommends restricting admin-interface access and keeping automatic updates enabled while patching is completed. Neither flaw is currently listed in CISA's KEV catalog or linked to known in-the-wild attacks, unlike the ESG's 2023 compromise by UNC4841, which exploited an unrelated zero-day.