Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
Read original article ↗AI Summary
Two vulnerabilities in Barracuda Email Security Gateway can be chained to achieve remote root access without authentication. CVE-2026-116606 is an authorization bypass that allows an unauthenticated attacker to restore a crafted configuration backup, which when combined with CVE-2026-111560, a command injection flaw, enables execution of arbitrary commands as root. The attack chain exploits a logic flaw in password change handling that grants access to a backup-restore function and leverages a hardcoded checksum secret to forge valid configuration backups. While patches are available, the vulnerabilities have not yet been added to CISA's KEV catalog and are not currently linked to any known attacks.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.