The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, affect Barracuda's email-filtering appliance and could allow remote attackers to bypass security restrictions and gain complete control of vulnerable systems.
According to cybersecurity firm watchTowr, which published its technical analysis, the attack chain combines an authorization bypass flaw with a command injection vulnerability. Barracuda released security patches for the issues earlier this week.
The first vulnerability, CVE-2026-116606, is an authorization bypass flaw that allows unauthenticated attackers to access a configuration restoration function and modify the appliance's global settings. The second, CVE-2026-111560, is a command injection vulnerability that enables commands to execute with root privileges.
Mandiant assigned CVSS severity scores of 9.3 and 8.6 to the two vulnerabilities, respectively.
How the attack chain works
In its technical investigation, watchTowr discovered that the authorization bypass stems from the appliance's password-change process. When a password change request fails, the system incorrectly returns a low-privilege user role instead of terminating the request completely.
The researchers also found that Barracuda's backup verification mechanism relies on a secret embedded within the appliance's code. Since this secret is not securely protected, attackers can generate a valid checksum for a specially crafted configuration backup and restore it on the targeted device.
The uploaded configuration can contain a manipulated timezone value. When the appliance processes this setting, it passes the value to a shell command that executes with root privileges.
watchTowr demonstrated the attack by successfully writing a file to the appliance with root-level permissions.
Affected products
CVE-2026-116606 affects Barracuda Email Security Gateway, while CVE-2026-111560 impacts five additional products, including Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).
However, the complete unauthenticated attack chain applies specifically to Email Security Gateway. Exploitation of the command injection vulnerability on the other affected products requires administrator access.
What next?
Barracuda has released security updates addressing both vulnerabilities and recommends that customers install the appropriate patches or upgrade to the latest fixed firmware versions.
As of the disclosure, neither vulnerability had been listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no publicly reported incidents linked the flaws to active exploitation.
