Barracuda discloses two flaws that chain to root on Email Security Gateway
A pre-authentication authorization bypass and a command injection can be combined, according to Barracuda's disclosure. The advisory doesn't say anyone has done it.
Barracuda has published details of two vulnerabilities in its products that, chained together, could let an attacker skip authorization checks and get root on a susceptible device. The Hacker News reported the disclosure on 3 November 2026.
One is a pre-authentication authorization bypass, tracked as CVE-2026-116606 with a CVSS score of 9.3. The other is a command injection. The article names both flaw types but gives the CVE identifier for only the bypass.
The CVE record describes the bypass as affecting Barracuda Email Security Gateway versions earlier than 9.4.0.030. An unauthenticated remote attacker can call a configuration-import function and restore a crafted, compatible backup archive, which changes the appliance's global configuration without authorization. Mandiant is credited as the CNA for that record.
What the reporting doesn't cover: whether either flaw has been exploited, whether the command injection has its own CVE, and what the second bug affects. The article also doesn't say whether a fix is out, though the version boundary in the CVE record points at 9.4.0.030.
For defenders running ESG, the version number is the first thing to check. The chaining claim comes from the disclosure, not from an observed intrusion, so we'd treat this as a patch-priority question rather than an incident.
CVE references
Sources
- Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root AccessPrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning