importantSYS.SOURCE: The Hacker News• 2026-11-06T11:09:10+05:30
Barracuda Email Security Gateway Vulnerability Allows Root Access Without Authentication
Two vulnerabilities in Barracuda's Email Security Gateway allow unauthenticated attackers to execute commands as root through a chained exploit. Patches were released by the company, with details disclosed by security firm watchTowr.
Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required.
The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday.
One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a
*** END OF TRANSMISSION ***