Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

Security researchers at watchTowr published details on an unauthenticated attack chain affecting Barracuda Email Security Gateway (ESG) appliances. By exploiting an authorization bypass (CVE-2026-116606) via a failed password change request, attackers can access backup restore functionality. When combined with a command injection flaw (CVE-2026-111560) in timezone processing, unauthenticated attackers can execute arbitrary shell commands as root. Barracuda has addressed these vulnerabilities in ESG firmware version 9.4.0.030 and later.

Source: The Hacker News

How Mangudai Discovers This Issue

Mangudai's port module detects exposed Barracuda Email Security Gateway management interfaces reachable from the internet and fingerprints software version banners to identify unpatched instances prior to version 9.4.0.030 associated with remote code execution CVEs.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain