Security researchers from watchTowr have demonstrated a sophisticated attack chain combining two distinct vulnerabilities in the Barracuda Email Security Gateway appliance. The technique allows an unauthenticated remote attacker to achieve root access on targeted systems without requiring any login credentials. Following the discovery, Barracuda has released firmware patches to address the security issues.
The newly detailed attack chain highlights how multiple lower-severity or isolated flaws can be combined to bypass perimeter defenses completely. Enterprise email security gateways represent high-value targets for attackers because they sit directly at the network edge and process inbound communications, making remote code execution vulnerabilities particularly dangerous if left unmitigated.
The vulnerability chain relies on two specific flaws assigned CVE records by Mandiant. CVE-2026-116606 is an authorization bypass flaw affecting the Email Security Gateway, which is rated 9.3 out of 10 and allows an unauthenticated attacker to restore a crafted configuration backup and modify global settings. The second issue, CVE-2026-111560, is a command injection vulnerability rated 8.6 out of 10 that executes arbitrary commands with root privileges.
In response to the findings, Barracuda released patches for each affected product, including fixed firmware version 9.4.0.030 and later for the Email Security Gateway. Alongside the patch release, watchTowr published a detection tool designed to help administrators check their appliances for vulnerability, though the security research firm deliberately withheld a working exploit.
Despite the severity of the demonstrated attack chain, there are currently no public reports linking these specific vulnerabilities to active exploitation or threat actor campaigns. Furthermore, neither flaw currently appears in the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalog.
Organizations utilizing the affected hardware should immediately update their systems to the latest patched firmware versions, such as Barracuda Email Security Gateway version 9.4.0.030 or later, as recommended by the vendor. Maintaining rigorous patch management routines remains a vital best practice for defending critical network appliances against evolving threat research techniques.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
