Critical Barracuda Flaw Allows Root Access Without Authentication
A pair of vulnerabilities in Barracuda's Email Security Gateway can be chained to gain full system control without logging in. Patches are now available from the vendor.
TL;DR
- Two unpatched flaws in Barracuda Email Security Gateway allow root-level command execution.
- No authentication required—attackers can exploit CVE-2026-116606 to bypass authorization.
- Security researchers at watchTowr demonstrated the full attack chain publicly.
- Barracuda issued fixes on Monday following coordinated disclosure.
- Organizations using affected appliances should patch immediately.
Cybersecurity researchers have uncovered a critical vulnerability chain in Barracuda’s Email Security Gateway that allows unauthenticated remote attackers to execute commands with root privileges. This means an attacker could take complete control of the device without needing any login credentials.
The issue stems from an authorization bypass flaw tracked as CVE-2026-116606, which when combined with another vulnerability, enables full system compromise. The vendor released patches on Monday after being notified by security firm watchTowr, which also published technical details of the exploit.
Technical Breakdown
- CVE-2026-116606 allows unauthorized users to initiate a password recovery process that bypasses normal authentication checks.
- Once exploited, attackers can leverage additional weaknesses to escalate privileges to root level.
- The entire attack can be carried out remotely over the network without requiring physical access or insider knowledge.
- watchTowr confirmed the exploit works against default configurations commonly found in enterprise environments.
Impact and Recommendations
- Organizations running Barracuda Email Security Gateway appliances should apply the latest patches immediately.
- Devices exposed to the internet or internal networks without proper segmentation are at high risk.
- Administrators should review logs for unusual activity related to password reset functions or unexpected root access.
- As a temporary mitigation, network-level restrictions can help limit exposure until patches are deployed.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.