Researchers show two patched Barracuda Email Security Gateway flaws chain to unauthenticated root access
Organisations running Barracuda email gateways have a short window to patch before a public pre-authentication chain on an internet-facing appliance draws exploitation attempts. Upgrade to 9.4.0.030 or later now, restrict access to the administrative interface, and confirm the status of other Barracuda products covered by the same advisories. Security teams should also treat this as a reminder to inventory edge appliances, which sit outside normal endpoint monitoring and tend to be exploited first.
What Happened
The Hacker News reports that watchTowr demonstrated how two patched Barracuda Email Security Gateway flaws can be chained to run commands as root with no login: CVE-2026-116606, an authorization bypass rated 9.3 out of 10 by Mandiant, and CVE-2026-111560, a command injection rated 8.6. Barracuda has released fixes for each affected product, with the Email Security Gateway fixed in version 9.4.0.030 and later. The report says neither flaw appeared in CISA's Known Exploited Vulnerabilities catalog that week, no public report ties either to an attack, and Beazley Security Labs notes these appliances have historically been targeted soon after vulnerabilities become known.
Why It Matters
Organisations running Barracuda email gateways have a short window to patch before a public pre-authentication chain on an internet-facing appliance draws exploitation attempts. Upgrade to 9.4.0.030 or later now, restrict access to the administrative interface, and confirm the status of other Barracuda products covered by the same advisories. Security teams should also treat this as a reminder to inventory edge appliances, which sit outside normal endpoint monitoring and tend to be exploited first.
Sources
- The Hacker News (opens in a new tab): Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login (2026-11-06)
More From This Briefing
- Pentagon CTO says US will publish the laws and rules that apply to domestic AI labs within weeks
- Google launches $15bn Malaysia investment for 2027-2028 as the country's data centre boom draws pushback
- Pentagon gives Machina Labs $9m trial to mass-produce airframes for LUCAS low-cost attack drones
- Ransomware attack takes down systems across all 66 Queens Public Library branches
More on Defense
- CISA adds exploited Apple pointer authentication bypass CVE-2024-27834 to KEV after Russia-linked campaign report (7 November 2026)
- CISA, FBI and three US departments warn of ongoing attacks on industrial refrigeration controllers (6 November 2026)
- CISA adds exploited WordPress Core race-condition flaw CVE-2026-119977 to KEV catalog (4 November 2026)
- Palantir's US commercial revenue passes US government revenue for the first time as quarterly sales top $2bn (3 November 2026)
Key Terms
- NIST AI Risk Management Framework: The NIST AI Risk Management Framework (AI RMF 1.0, published January 2023) is a voluntary US framework for managing AI risk, organised...
- Known Exploited Vulnerabilities (KEV) catalog: The Known Exploited Vulnerabilities catalog is a list maintained by the US Cybersecurity and Infrastructure Security Agency (CISA) of...
- CVE: A CVE (Common Vulnerabilities and Exposures) identifier is a unique public reference, such as CVE-2026-12345, assigned to a specific...
Filed under Defense and National Security, Cybersecurity and AI Threats, Barracuda Networks.
This story is part of the Laurenceo Intelligence briefing for 8 November 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.