Barracuda patched two flaws that together let an attacker take full control of its Email Security Gateway with no login. Businesses using it should update.
Barracuda has fixed two security flaws that, used together, let an attacker take full control of its Email Security Gateway without logging in. The company released patches on Monday. A security firm called watchTowr explained how the attack works on Thursday. If your business runs this email filter, it needs the update.
The Email Security Gateway is an appliance that filters email. Two bugs in it can be chained, meaning one opens the door for the other. The result is that an attacker can run commands as root, which is the highest level of access on a system.
The first bug, CVE-2026-116606, is an authorization bypass. It lets someone who has not logged in restore a specially made configuration backup and change the device's global settings. The second, CVE-2026-111560, is a command injection. It lets an attacker run commands as root, but normally only with an administrator account. On this product, the first bug hands the attacker that access.
Full control of an email filter could expose your company's email traffic. According to watchTowr, the weak spot is a mix of small mistakes. A failed password change gives the visitor a low-level role instead of stopping the request. The backup is protected by a checksum, a kind of seal, but the secret behind it is built into the code, so an attacker can forge it. watchTowr proved the attack by writing a file to the device as root.
The full no-login chain applies to the Email Security Gateway. The first bug affects only that product. The second bug also reaches five other Barracuda products, but on those it still needs an administrator account, so the risk there is lower. Those products still have patches, and Barracuda lists the fixed versions in its security advisory.
Mandiant, which assigned the two CVE records, rates the bypass 9.3 out of 10 and the command injection 8.6. Both scores are high.
There is no sign of attacks yet. Neither flaw is on CISA's Known Exploited Vulnerabilities list, and no public report ties either one to an attacker. watchTowr released a tool that checks whether a device is vulnerable. It has not published an exploit, which is the code an attacker would use.
This product has been targeted before. In 2023, a group tracked as UNC4841 exploited a different flaw, CVE-2023-2868, before a fix existed. That case is unrelated to these two flaws, and nothing links the new pair to any attacker.
The alert box above lists the steps. The key point is that the Email Security Gateway is fixed in version 9.4.0.030 and later. Watch for two things next: whether CISA adds either flaw to its exploited list, and whether anyone publishes working attack code. Either would raise the urgency.
If you run Barracuda's Email Security Gateway, update it to version 9.4.0.030 or later, and have your IT provider confirm it.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
