Barracuda ESG chain gets root without a login, watchTowr shows
Two flaws in the email-filtering appliance chain to root access with no credentials. Barracuda shipped patches on Monday; watchTowr published the chain on Thursday.
Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root with no login required. Barracuda released patches on Monday. The security firm watchTowr detailed the attack chain on Thursday.
One of the two, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a crafted backup archive, which changes the appliance's global configuration. Mandiant's advisory scores it 9.3 under CVSS 4.0 and lists versions earlier than 9.4.0.030 as affected. The second flaw in the chain isn't described in the reporting we have.
The reporting is a demonstration, not an incident. Nobody has said the chain was used against anyone, and the source gives no figure for exposed appliances. Barracuda's own advisory is the place to check the fixed build and any interim mitigation.
If you run an ESG, the version number is the first thing to look at. Anything below 9.4.0.030 is in the affected range as Mandiant states it. We'd treat internet-facing appliances as the priority, since the bypass needs no credentials.
What's still open: whether the second flaw has its own identifier, and whether Barracuda has seen exploitation. Neither is answered in what's been published so far.
CVE references
Sources
- Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without LoginPrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning