Barracuda’s email security gateways bitten by make-me-root vulns
Security company Barracuda warns that attackers are exploiting a pre-authentication authorization bypass bug and a command-injection vulnerability in its popular Email Security Gateway (ESG) products that, when chained, could allow the crims to run commands with root privileges.
Key points
- We don’t yet know who is responsible for the attacks, or whether the intruders gained root access – but if they did, they could steal data, install backdoors, and take full control of affected systems.
- These types of edge-device exploits have been used by Chinese-government spies, and in 2023 the FBI blamed PRC-linked attackers for a series of attacks that targeted Barracuda ESGs to deploy custom malware and maintain access to high-value networks.
- “We have identified exploitation activity affecting a small number of organizations,” the security vendor said in a late Monday night update to its earlier security advisory.
“If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device,” Barracuda warned on November 2.
Additional details
- Barracuda declined to answer The Register ’s questions, including one about how many organizations have been hit by attackers.
- While authentication is not required to exploit this vulnerability, the attacker must have access to the administrative user interface.
- A company spokesperson told us that it “worked directly” with the affected businesses “to quickly address the issue.
- According to Mandiant, 27 percent of identified affected organizations were government entities.
- CVE-2026-116606 is a 9.3 CVSS-rated, pre-authentication authorization bypass flaw in ESG.
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →
Advertisement
Every article behind this summary — 1 article from 1 outlet
Get stories like this in your inbox.
Subscribe — it's freeOne free email at 6am — your topics, deduplicated, five minutes. No account, no paywall.