Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

Two flaws in Ba­rra­cu­da's Email Se­cu­rity Ga­te­way, an email-fil­te­ring ap­plian­ce, can be chai­ned to run com­mands on it as root, its highest level of ac­cess, with no login re­qui­red. The com­pany re­lea­sed pat­ches on Mon­day, and the se­cu­rity firm watch­Towr de­tai­led the at­tack chain on Thurs­day. One flaw, CVE-2026-116606, is an autho­ri­za­tion by­pass. An unauthen­ti­ca­ted at­tac­ker can use it to res­to­re…