Summary

Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a

For more information, read the full story at the original source: The Hacker News ↗

Vulnerabilities in this story

• CVE-2023-2868 KEV · fix by 2023-06-16 Barracuda Email Security Gateway EPSS 86.8% 9.4Critical
• CVE-2026-116606 Barracuda Networks Barracuda Email Security Gateway EPSS 1.6% 9.3Critical
• CVE-2026-111560 Barracuda Networks Barracuda Email Security Gateway, Barracuda Networks Barracuda Load Balancer Application Delivery Controller, Barracuda Networks Barracuda Message Archiver EPSS 1% 8.6High

Also reported by

• Security Affairs: Security Affairs newsletter Round 603 by Pierluigi Paganini – INTERNATIONAL EDITION ↗