Source: thehackernews.com
Two vulnerabilities in Barracuda's Email Security Gateway (ESG) appliance can be chained together to achieve unauthenticated root-level command execution. One of the flaws, CVE-2026-116606, is an authorization bypass that allows unauthenticated attackers to interact with the device without credentials. When combined with a second vulnerability, an attacker can run arbitrary commands as root, the highest privilege level on the system. Barracuda released patches on Monday following discovery of the flaws. Security firm watchTowr publicly detailed the attack chain on Thursday after patches were available. The vulnerabilities represent a critical risk to organizations using the ESG appliance for email filtering. No login is required to exploit the chain, making it particularly dangerous for internet-exposed devices.
