Barracuda: two chained flaws grant root without login

A chain of flaws that turns an email filter into a backdoor

Email security is back in the spotlight. As reported by The Hacker News, two vulnerabilities in Barracuda Email Security Gateway —the appliance that many companies place in front of their mail server to filter spam, phishing and malware— can be chained to execute commands on the device with root privileges, the highest level of access, and without the need to authenticate beforehand.

The vendor released the patches on Monday and the security firm watchTowr detailed the attack chain on Thursday. One of the flaws, identified as CVE-2026-116606, is an authorization bypass that allows an unauthenticated attacker to take advantage of the device's own restore functionality to slip into it. From there, the second piece of the chain completes the jump to command execution as root.

Why this matters more than it seems

An email gateway is not just any server. It is exposed to the Internet by design, because it needs to receive SMTP traffic from all over the world, and it sits in a privileged position: it sees every message in the organization pass through, it knows the internal addresses and, in many configurations, it integrates with the corporate directory. If an attacker gains root on that device, they don't just control the filter: they can read email, manipulate it, use the device as a springboard into the internal network or silently disable the security rules.

The pattern described by watchTowr —an authorization flaw that opens the door and a second flaw that escalates privileges— is increasingly common. Attackers only need to chain two medium weaknesses to achieve critical impact. And that forces small and medium businesses to change the way they look at updates: it is not enough to patch what seems serious in isolation, the full package must be applied quickly.

What it means for an SME or an IT team

• Real risk, not theoretical: the device is exposed and the flaw does not require credentials. Any organization with an unpatched Barracuda ESG should treat it as a priority.
• Email is the most sensitive asset: losing control of the anti-spam filter is equivalent to opening the door to impersonation, CEO fraud and information exfiltration.
• The window between patch and public exploit is shrinking: only a few days passed between Monday and Thursday. Those who did not update within that margin were exposed to a public proof of concept.
• The supply chain matters: third-party appliances concentrate trust. If one fails, it drags down the entire organization.

Our recommendations from ForgeNEX

1. Update the Barracuda ESG now to the patched version indicated by the vendor. If you cannot do so in the next few hours, consider isolating the device or restricting access to its administration interface.
2. Review the logs of the appliance for anomalous access, unscheduled restores or configuration changes that no one recognizes. The restore functionality is the one that appears in the described chain.
3. Limit exposure: gateway administration should not be accessible from any IP. Segment and control who can reach it.
4. Establish a patching process with deadlines. Authentication flaws on perimeter devices should have an SLA of hours, not weeks. In this blog we have already seen similar cases with OpenSSH and with Zyxel GS1900, where the previous patch did not close the real problem.
5. Don't rely on the filter alone: complement it with email authentication (SPF, DKIM, DMARC), employee training and endpoint detection. Defense in depth remains the best policy for an SME.

The underlying lesson

Email security devices are high-value targets because they are on the border and handle sensitive information. The Barracuda chain shows that a seemingly minor authorization flaw can become root if combined with another weakness. For an SME's IT team, the conclusion is clear: keep perimeter appliances inventoried, know their version, have an update plan and assume that the vendor will publish an urgent advisory someday. The difference between an incident and a scare usually lies in having acted within the first 24 hours.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.