Barracuda Email Security Gateway chained flaws enable root access

Two vulnerabilities in Barracuda's Email Security Gateway can be chained to grant unauthenticated attackers root-level command execution. CVE-2026-116606, an authorization bypass, allows unauthorized access without login. Barracuda released patches Monday; watchTowr disclosed full attack details Thursday. Organizations running the appliance should apply patches immediately to prevent remote compromise.