SoBasically
← FrontpageCISA hallmark logoCISAAnalysis

CISA adds chained Barracuda Email Gateway auth bypass and root RCE flaws to KEV catalog

Abhishek Gawade
Abhishek GawadeinSoBasically
1 min readEdition: 2026-11-11-cybersecurity-advisories
Topographic elevation contour card for CISA adds chained Barracuda Email Gateway auth bypass and root RCE flaws to KEV catalog
VISUAL ARTWORK:Original editorial artwork. Third-party brand marks used under nominative fair use.

What happened.CISA ordered federal agencies to patch chained authentication bypass and command injection vulnerabilities in Barracuda Email Security Gateway appliances.

Why it matters.Edge email gateways inspect inbound traffic at corporate perimeters. When chained flaws yield root execution, attackers decrypt traffic and establish persistent footholds. Infrastructure teams must apply firmware updates immediately and restrict management access from public routing.

The technical specifications:

  • Vulnerability mechanics: Tracked as CVE-2026-116606 and CVE-2026-111560, the flaws affect appliance backup restoration and timezone configuration parsing.
  • Exploit chain: Remote attackers exploit the alternate path authorization bypass on administrative interfaces to restore crafted backups without credentials.
  • Root execution: Intruders subsequently pass shell metacharacters into timezone fields to execute arbitrary commands with root privileges.
  • Appliance impact: While authorization bypass affects email gateways, the command injection flaw spans Barracuda load balancers, firewalls, and archivers.
  • Remediation releases: Barracuda released firmware update 9.4.0.030 alongside hotfixes BNSF-40425 and BNSF-40430, advising teams to restrict management access.
TOPICS:
#security#zero-day#exploit-in-the-wild#critical-infrastructure