[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fM8NKKdzjCR7LUWN_Gzfqdl60NJuSRxaMh4gwIlKomCI":3},{"article":4,"iocs":52,"watch_terms":60,"solutions":61,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"300daa24-1e38-493a-afce-4607278e3c7e","Barracuda Confirms Active Exploitation of Email Gateway Flaws Allowing Root Access","barracuda-confirms-active-exploitation-of-email-gateway-flaws-allowing-root-acce-05ecbd","Barracuda has confirmed active exploitation of security flaws affecting its Email Security Gateway (ESG), warning that attackers could combine two vulnerabilities to gain root access without logging in. In a November 9, 2026, update issued at 9:00 p.m. EST, the company said exploitation had affected a small number of organizations. The flaws, tracked as CVE-2026-116606 […] The post Barracuda Confirms Active Exploitation of Email Gateway Flaws Allowing Root Access appeared first on Cyber Security News.","Barracuda has confirmed active exploitation of two vulnerabilities (CVE-2026-116606 and CVE-2026-111560) in its Email Security Gateway that allow attackers to gain root access without logging in by chaining an authorization bypass with command injection. The flaws affect a small number of organizations, and patches are available: BNSF-40425 for ESG versions 9.4.017 and later, or BNSF-40430 for earlier versions, with additional patches for related products. Barracuda recommends restricting administrative interfaces to trusted internal networks and applying all applicable security patches immediately.","Barracuda confirms active exploitation of Email Security Gateway flaws enabling unauthenticated root access.","https:\u002F\u002Fcybersecuritynews.com\u002Fbarracuda-email-gateway-flaws\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FBarracuda-email-gateway-flaws-2.webp","2026-11-10T16:05:32+00:00","2026-11-10T17:00:27.276468+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Barracuda","vendor",{"name":21,"type":22},"Email Security Gateway (ESG)","product",{"name":24,"type":22},"Load Balancer Application Delivery Controller",{"name":26,"type":22},"Web Application Firewall",{"name":28,"type":22},"Message Archiver",{"name":30,"type":22},"Web Security Gateway","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",[53,57],{"type":54,"value":55,"context":56},"cve","CVE-2026-116606","Pre-authentication authorization bypass in Barracuda Email Security Gateway (CVSS 9.3)",{"type":54,"value":58,"context":59},"CVE-2026-111560","Command injection flaw in Barracuda Email Security Gateway and related products (CVSS 8.6)",[18,21,24],{"controls":62,"vendors":146},[63,92,117],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":93,"name":94,"problem":95,"products":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",[97,101,109],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":93,"product_name":98,"url":99,"description":100},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":118,"name":119,"problem":120,"products":121},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","next-generation-firewall","Next-Generation Firewalls","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fnetwork-security\u002Fnext-generation-firewall","Hardware, virtual and cloud firewalls running PAN-OS, with intrusion prevention.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","quantum-firewall","Quantum Force firewalls","https:\u002F\u002Fwww.checkpoint.com\u002Fquantum\u002Fnext-generation-firewall\u002F","Next-generation firewalls with threat prevention.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":157},"chained-auth-bypass-and-command-injection-grant-root-access-to-barracuda-email-gateways","Chained Auth Bypass and Command Injection Grant Root Access to Barracuda Email Gateways","Attackers actively exploited two vulnerabilities in Barracuda's Email Security Gateway by chaining an authorization bypass with a command injection flaw, ultimately gaining root-level access without any valid credentials. This combination is especially dangerous because neither vulnerability alone may appear critical, but together they provide full system compromise with no authentication required. The incident highlights the severe risk posed by internet-exposed administrative interfaces on network appliances, which are high-value targets and often overlooked in patch cycles. Organizations running perimeter security appliances must treat them with the same — or greater — urgency as internal systems, applying patches immediately and restricting management access to trusted networks only.",[152,153,154,155,156],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 12: Network Infrastructure Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","OWASP A01:2021 Broken Access Control",{"NIST SP 800-53 AC-17: Remote Access":158,"OWASP A01:2021 Broken Access Control":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"CIS Control 12: Network Infrastructure Management (v8)":161,"CIS Control 7: Continuous Vulnerability Management (v8)":162},"AC-17 requires organizations to control and monitor remote access to systems; exposing the ESG administrative interface to untrusted networks directly enabled attackers to reach and exploit the authorization bypass vulnerability.","The authorization bypass component of this exploit chain is a direct instance of broken access control, allowing unauthenticated attackers to reach privileged functionality that should have required valid credentials.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner; the active exploitation of these patched-but-unpatched vulnerabilities reflects a failure to apply available fixes before attackers could act.","CIS Control 12 calls for securing and managing network infrastructure devices, including restricting administrative access to trusted networks — the exact mitigation Barracuda recommended to limit exposure of the vulnerable management interface.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; applying the available Barracuda patches promptly in response to active exploitation is exactly what this control mandates."]