AI Image
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
The Hacker News • • technology
Key Points:
- Two vulnerabilities in Barracuda's Email Security Gateway can be chained to execute root-level commands without login, involving an authorization bypass (CVE-2026-116606) and a command injection (CVE-2026-111560).
- The authorization bypass allows unauthenticated attackers to restore a crafted configuration backup and alter global settings, while the command injection normally requires admin access but is bypassed on this appliance.
- Barracuda has released patches for the affected products, with the Email Security Gateway fixed in firmware version 9.4.0.030 and later, and recommends applying patches, restricting admin interface access, and enabling automatic updates.
- The attack chain exploits a flaw where a failed password change returns a low-privilege role and opens backup-restore functionality, which can be manipulated to run shell commands as root using a forged checksum.
- Neither vulnerability is currently listed in CISA's Known Exploited Vulnerabilities catalog, no public exploits have been reported, and there is no evidence linking these flaws to active attacks.
