Two Flaws Chained. Root With No Login.

Your email gateway sits at the edge of the network, sees every message coming in, and is trusted by everything behind it. This week, researchers showed how two flaws in Barracuda’s Email Security Gateway fit together into the worst version of that story: an attacker who has never logged in to the appliance — who has no account on it at all — can end up running commands on it as root.

What happened

The chain uses two vulnerabilities. The first, CVE-2026-116606, rated 9.3 out of 10, is an authorization bypass in the Email Security Gateway. Buried in the appliance’s code, a failed password change returns a low-privilege role instead of rejecting the request outright — and that leftover access leaves the configuration backup restore function open to someone who has not authenticated. The second flaw, CVE-2026-111560, rated 8.6, is a command injection that executes as root. On its own it normally demands an administrator account — which is exactly what the bypass hands over.

The mechanics are almost elegant. The restore function accepts an uploaded backup, and one of the values inside that backup — the timezone setting — is later executed by the appliance as a shell command with root privileges. Backups are protected by a checksum, but the secret used to compute it is built into the product’s own code, so a valid checksum can be forged. Put the two together and the sequence is: no login, upload a crafted backup, wait for the appliance to run your command as root. Researchers at watchTowr demonstrated the chain by writing a file to the appliance as root.

Barracuda released patches on Monday for each affected product. The Email Security Gateway is fixed in firmware 9.4.0.030 and later. The command injection flaw also reaches five other Barracuda products, though on those it still requires an administrator account to exploit. Neither flaw is in CISA’s Known Exploited Vulnerabilities catalog, no public report ties either one to a real attack, and watchTowr published a detection tool rather than an exploit.

Why this one matters

An email security gateway is not a peripheral. It processes every inbound and outbound message, holds TLS certificates and directory credentials, and sits in a position of deep trust relative to the mail servers behind it. Root on that box is a surveillance post on an organization’s entire mail flow and a launchpad into the network — from a vulnerability that needs no credentials whatsoever.

It is also the second time this appliance family has been the story. In 2023, a different Barracuda ESG flaw was exploited as a zero-day by a group tracked as UNC4841, a case Barracuda handled by replacing some appliances outright. That incident is unrelated to this week’s pair — but it is the reason “patch the email gateway later” should not be a sentence anyone says out loud anymore. Unauthenticated flaws on edge appliances are the ones attackers industrialize first, precisely because there is no password standing in the way.

What to do now

• Patch or upgrade first. Apply the Barracuda patch for each affected product you run; Email Security Gateway appliances should be on firmware 9.4.0.030 or later. This is the only step that actually closes the chain.
• Restrict the admin interface today. If patching has to wait even a day, limit the appliance’s administration interface to trusted internal networks only. An unauthenticated flaw matters a lot less when the internet cannot reach the surface it lives on.
• Turn automatic patching back on. If auto-update was disabled on your appliances, re-enable it. Barracuda’s own advisory calls this out, and edge appliances are the last devices that should depend on someone remembering a firmware Friday.
• Check whether you were exposed. Run watchTowr’s published detection tooling against your appliances, and review configuration restore and backup activity for anything you do not recognize — a restored backup nobody on your team performed is a red flag worth chasing.

Two individually serious bugs became one critical one because they composed. That is how modern appliance compromises work: not a single master key, but a bypass that hands over just enough access for the next flaw to finish the job. The patch window on a no-login root chain is measured in days, not maintenance cycles — close it while it is still just a research write-up.