ChordNews
← All news

Two Chainable Barracuda Email Security Gateway Flaws Allow Unauthenticated Root Access

By ChordNews · First written

Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
Image: thehackernews.com
Comments 0

Summary

Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on the device as root, its highest level of access, without logging in. Barracuda released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass that an unauthenticated attacker can use to get past access controls. The Hacker News reported the findings from the watchTowr research, and the article summary available for this draft does not include the remaining details of the second flaw.

This continues an earlier story: Barracuda Warns of Two Chainable Flaws That Could Give Attackers Root Access

Timeline

  1. The Hacker News

    Source ↗

    Reports that two flaws in Barracuda's Email Security Gateway can be chained to run commands as root with no login required, that Barracuda released patches on Monday, and that watchTowr detailed the attack chain on Thursday.

Comments

No comments yet.

    to like and comment.

    © 2026 ChordNews