[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5LFcmm5w_uf7ylwib1UInqtqWW8v-_cej2rCLW4uCXI":3},{"article":4,"iocs":44,"watch_terms":51,"solutions":52,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"c03e20af-f29f-4ee8-8f8c-9ef95e3aa881","Hackers now exploit critical Barracuda ESG flaws to gain root access","hackers-now-exploit-critical-barracuda-esg-flaws-to-gain-root-access-40f3a4","Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. [...]","Barracuda Networks is alerting customers to the active exploitation of two critical vulnerabilities in its Email Security Gateway (ESG) devices. These flaws, CVE-2026-116606 and CVE-2026-111560, can allow attackers to gain root access and bypass authorization controls, especially when exploited in combination. Barracuda has released patches and urges customers to apply them immediately, particularly if automatic patching is disabled.","Barracuda warns of active exploitation of critical ESG vulnerabilities allowing root access.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F10\u002FBarracuda.jpg","2026-11-10T10:10:20+00:00","2026-11-10T11:00:09.752366+00:00",9,[17,20,23],{"name":18,"type":19},"Barracuda Networks","vendor",{"name":21,"type":22},"Email Security Gateway (ESG)","product",{"name":24,"type":25},"UNC4841","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49],{"type":46,"value":47,"context":48},"cve","CVE-2026-116606","Barracuda ESG vulnerability allowing root access",{"type":46,"value":50,"context":48},"CVE-2026-111560",[18,21],{"controls":53,"vendors":141},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":113,"name":114,"problem":115,"products":116},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortigate","FortiGate","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Fnext-generation-firewall","Next-generation firewalls with intrusion prevention and SD-WAN.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"sonicwall","SonicWall","\u002Fvendor-logos\u002Fsonicwall.png","sonicwall-firewalls","SonicWall firewalls","https:\u002F\u002Fwww.sonicwall.com\u002Fproducts\u002Ffirewalls","Next-generation firewalls for small business to enterprise.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":154},"critical-barracuda-esg-flaws-exploited-for-root-access","Critical Barracuda ESG Flaws Exploited for Root Access","Attackers are actively exploiting two critical vulnerabilities in Barracuda Email Security Gateway appliances, chaining them together to achieve root-level access and bypass authorization controls — a highly dangerous combination for any organization relying on these devices as a mail security perimeter. The fact that exploitation is occurring in the wild means organizations that disabled automatic patching or delayed updates are now directly exposed to full device compromise. Email security gateways are high-value targets because they sit at the boundary of an organization's communications infrastructure, making compromise especially damaging. This incident underscores that disabling automatic patching on internet-facing appliances — even temporarily — can create a critical window of exposure that adversaries are actively watching for.",[147,148,149,150,151,152,153],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":155,"PCI DSS Requirement 6":156,"NIST SP 800-53 SI-2: Flaw Remediation":157,"OWASP A06:2021 Vulnerable and Outdated Components":158,"CIS Control 7: Continuous Vulnerability Management":159,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":160,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":161},"NIS2 requires essential and important entities to implement incident handling and patch management practices — operators of email security infrastructure are obligated to apply critical patches promptly under this directive.","PCI DSS Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches in a timely manner, which would have required prompt remediation of these critical ESG vulnerabilities.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined timeline — a mandatory patching SLA would have closed these vulnerabilities before attackers could chain them for root access.","The ESG devices running unpatched firmware are a textbook example of vulnerable components in production use, the exact risk OWASP A06 warns organizations to monitor and remediate continuously.","Regular, automated vulnerability scanning of internet-facing ESG appliances would have identified the unpatched CVEs and triggered remediation before active exploitation began.","This control explicitly requires timely identification and remediation of technical vulnerabilities in deployed systems, which directly addresses the failure to apply Barracuda's patches before exploitation occurred.","One of the chained flaws bypasses authorization controls; hardened access control configurations and principle-of-least-privilege enforcement on the ESG could have limited the impact of that vulnerability."]