Analysis of two flaws in Barracuda's Email Security Gateway shows they can be chained for unauthenticated root command execution.
Review CVE-2026-116606 and CVE-2026-111560 details and apply available vendor patches.
Researchers who analyzed the case made the details public on Thursday, while the company had been releasing fixes since Monday.
How are the problems connected?
The first issue allows strangers to bypass controls and restore settings from a backup without having an account. The second issue involves executing commands on the system, which normally requires administrator access. When the two issues are combined, someone can reach the highest levels of access on the device.
According to the experts who documented the problems, the process exploits a password change failure that leaves the system open to resetting settings. In addition, the system used a built-in security code that allowed authentication checks to be bypassed.
What is affected and what needs to be done
The first issue concerns only the company's core email filtering system. The second issue affects five other products, which normally require an administrator account.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Issue in ChatGPT could allow hidden copying of conversations without clicking
↗
Barracuda has already released software updates for all affected products. For the email protection system, the fix is included in version 9.4.0.030 and later.
Experts recommend that administrators apply updates immediately, enable automatic patch installation, and limit management access to only trusted internal network areas.
So far, there are no reports that these new issues have been used in real attacks, while researchers have released a tool to detect them.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)