Critical Authorization Bypass (CVE‑2026‑116606) in Barracuda Email Security Gateway Enables Root Access Without Login
What It Is — Researchers from watchTowr disclosed a chain of two vulnerabilities in Barracuda’s Email Security Gateway appliance. The first, CVE‑2026‑116606, is an unauthenticated authorization‑bypass that lets an attacker invoke a privileged restore function. When combined with a second, undocumented flaw, the attacker can execute arbitrary commands as the root user, achieving full system control without any valid login. The issue is exploitable over the network, has been assigned a CVSS ≥ 9.0 (critical), and affects all supported versions of the gateway released before the patches issued on 2026‑11‑04. Barracuda has published patches and recommends immediate deployment.
Affected Products – Barracuda Email Security Gateway (all versions prior to the 2026‑11‑04 security update).
Why It Matters for Trust & Control Assurance – The chain bypasses authentication and escalates privileges, directly testing the control objective of preventing unauthorized privileged access. Organizations that rely on the appliance must prove that access controls are enforced and that remediation evidence is continuously collected.
Recommended Actions –
- Deploy Barracuda’s November 2026 patches on all Email Security Gateway instances without delay.
- Verify that the patch is applied by checking the appliance firmware version and confirming the fix via the vendor’s advisory.
- Review and harden any remaining privileged‑access pathways (e.g., SSH, API) and ensure they are logged and monitored.
- Capture remediation evidence (patch version, configuration snapshots) for audit‑readiness.
Source: The Hacker News