Two significant vulnerabilities have been identified in Barracuda’s Email Security Gateway, an essential tool for filtering emails. These flaws can be exploited together to execute commands with root privileges without requiring authentication.
Details of the Vulnerabilities
Barracuda addressed these vulnerabilities by releasing patches earlier this week. Security firm watchTowr provided an in-depth analysis of the attack chain shortly after. The first flaw, identified as CVE-2026-116606, is an authorization bypass that allows an unauthorized attacker to restore a crafted configuration backup and modify the system’s global settings.
The second flaw, CVE-2026-111560, involves command injection. Typically, this would require an administrator account, but in the Email Security Gateway, the authorization bypass grants attackers the necessary access. When combined, these vulnerabilities enable attackers to execute commands as root without login credentials.
Impacted Products and Mitigations
While the authorization bypass specifically affects the Email Security Gateway, the command injection flaw also impacts five other products, although an administrator account is still needed for those. The security ratings for these vulnerabilities are high, with Mandiant assigning a score of 9.3 for the bypass and 8.6 for the command injection.
Barracuda has made patches available for all affected products. The Email Security Gateway is patched in version 9.4.0.030 and later. Users are advised to apply these patches immediately, restrict administrative interface access to trusted networks, and re-enable automatic updates if they have been disabled.
Technical Analysis and Response
According to watchTowr, the attack chain exploits a code flaw where a failed password change returns a low-privilege role instead of blocking access. This oversight leaves the backup-restore function vulnerable to unauthorized users.
The function’s implementation allows uploading backups, including a timezone value that the system executes as a shell command with root access. Although Barracuda secures backups with a checksum, the secret for computing it is embedded in the code, enabling attackers to generate a valid checksum and execute commands as root. watchTowr demonstrated the severity of this flaw by creating a file on the system with root privileges.
Currently, neither of these vulnerabilities is listed in CISA’s Known Exploited Vulnerabilities catalog, and no public exploits have been reported. However, watchTowr has developed a detection tool to assess system vulnerability. The recent discovery is distinct from a 2023 attack by UNC4841, which exploited a different zero-day vulnerability in the same product line.
These security concerns underscore the importance of staying vigilant and keeping systems up-to-date with the latest security patches to protect against potential threats.
