# Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

Source: [The Hacker News](https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html) · 2026-11-06 · Security
Page: https://themorning.dev/story/experts-demonstrate-barracuda-email-security-gateway-chain-enabling-root-access-a382c3d13c65e931
Kind: security · Impact: high

## In brief

- Two flaws in Barracuda's Email Security Gateway, an authentication bypass and a command injection, can be chained to run commands as root.
- The chain needs no login, according to watchTowr Labs, which detailed the attack.
- Barracuda released patches for the flaws.

## Why it matters

An unauthenticated path to root on an internet-facing email gateway gives an attacker full control of the appliance, including the mail it filters, so affected appliances should be patched promptly.

## What to do

- Apply the patches Barracuda released for the Email Security Gateway appliance

## CVEs

- CVE-2026-116606
- CVE-2026-111560

## Timeline

- 2026-11-04: SecurityWeek reports that an authentication bypass and a command injection flaw can be chained for root access
- 2026-11-05: watchTowr Labs publishes the detailed pre-auth remote root attack chain

## Coverage

- [Hackers now exploit critical Barracuda ESG flaws to gain root access](https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/) — BleepingComputer, 2026-11-10
- [Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login](https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html) — The Hacker News, 2026-11-06
- [Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)](https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/) — watchTowr Labs, 2026-11-05
- [Barracuda ESG Authentication Bypass Flaw Opens Path to Root](https://www.securityweek.com/barracuda-email-security-gateway-authentication-bypass-opens-path-to-root/) — SecurityWeek, 2026-11-04

Tags: barracuda, email-security, authentication-bypass, command-injection, root-access, vulnerability

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev