Barracuda Email Security Gateway Flaw CVE-2026-116606 Allows Unauthenticated Root Access

Key points

• CVE-2026-116606 affects Barracuda Email Security Gateway.
• No login is needed; the flaw enables authorization bypass and root command execution.
• watchTowr published the attack chain on Monday.
• Barracuda released patches by Thursday.
• Prioritize patching internet-facing gateways.

Barracuda has shipped fixes for a high-severity defect in its Email Security Gateway, tracked as CVE-2026-116606. According to research from watchTowr, the issue can be reached without any credentials, allowing an outside party to slip past authorization checks and run commands with root privileges on the appliance. The vendor's patches were available by Thursday, after the research team laid out the full exploit path on Monday.

Because the gateway sits at the edge of the mail flow, exploitation does not require a mailbox or a valid session. An attacker who reaches the management surface could chain the authorization weakness with other flaws to move from an unauthenticated request to privileged execution. That combination is what elevates the bug from a simple access-control error to a potential full-appliance compromise.

For school districts and public-sector email teams, the practical concern is exposure. Internet-facing gateways are common, and many are managed by small IT teams with limited maintenance windows. A root-level compromise could let an intruder read or alter mail, change filtering rules, persist on the device, or use it as a pivot into adjacent systems. Even if no exploitation has been confirmed in a given environment, the absence of a login barrier lowers the skill needed to attempt an attack.

watchTowr's write-up matters because it turns a patch advisory into an actionable attack narrative. Defenders should assume that public details will invite scanning and exploitation attempts. The window between Monday's disclosure and Thursday's fixes was short, but appliances that remain unpatched are still at risk. Organizations should verify their version, restrict administrative access, and review logs for unexpected command activity or configuration changes.

Watch for follow-up reporting on active exploitation, proof-of-concept availability, and whether the vendor's fix fully closes the chain. Until then, treat internet-exposed Email Security Gateways as high-priority assets and confirm that compensating controls are in place for any device that cannot be updated immediately.

What to do now

1. Apply Barracuda's patched firmware to every Email Security Gateway, starting with internet-facing units; confirm the build number after reboot.
2. Remove direct public access to the gateway's administrative interface; place it behind VPN, allowlisted management network, or zero-trust proxy.
3. Rotate credentials and API tokens associated with the appliance, and review local accounts for unauthorized additions.
4. Hunt logs for unauthenticated requests, authorization failures, unexpected root-level commands, new cron jobs, or altered mail-routing rules around Monday-Thursday.
5. Segment the gateway from other systems and limit outbound access to only required mail and update endpoints.
6. Enable centralized logging and alerting for configuration changes and command execution on the appliance.
7. If patching is delayed, consider temporary isolation or vendor-supported mitigation; document risk acceptance.

CVE references

• CVE-2026-116606

Original source

The Hacker News