Tag

Barracuda Networks

All articles tagged with #barracuda networks

security1 day ago•10 min saved

Barracuda Patches Critical Chain Granting Unauthenticated Root Access on Email Security Gateway

Barracuda has released patches for two vulnerabilities that can be chained to achieve unauthenticated root access on its Email Security Gateway (ESG). CVE-2026-116606 is a pre-authentication authorization bypass, while CVE-2026-111560 is an OS command injection flaw. According to watchTowr Labs, the authorization bypass allows attackers to trigger backup restore functions without valid credentials. This process executes a command injection vulnerability as root, enabling arbitrary code execution. Barracuda advises customers to update firmware immediately and restrict administrative interface access to trusted internal networks.

via watchTowr Labs|

#barracuda-networks #cve-2026-111560 #cve-2026-116606

cybersecurity3 years ago•2 min saved

China-linked hackers exploit Barracuda ESG zero-day vulnerability to breach public and private networks.

Chinese state-backed hackers used a security vulnerability in Barracuda Networks' Email Security Gateway to breach hundreds of public and private sector organizations globally, including nearly a third of government agencies, according to cybersecurity firm Mandiant. The hackers sent emails containing malicious file attachments to gain access to targeted organizations’ devices and data. Mandiant said the majority of the impact was in the Americas, reflecting the geography of Barracuda's customer base. Barracuda is providing replacement appliances to affected customers at no cost.

via ABC News|

#barracuda-networks #chinese-hackers #cyber-espionage

cybersecurity3 years ago•2 min saved

Barracuda Urges Immediate Replacement of Vulnerable Email Security Appliances.

Barracuda Networks urged its Email Security Gateway (ESG) customers to replace affected appliances instead of patching them after discovering a zero-day vulnerability that allowed attackers persistent backdoor access to the devices. The company said the malware was identified on a subset of appliances, and evidence of data exfiltration was identified on some systems. Experts suggest that the malware was able to corrupt the underlying firmware that powers the ESG devices in some irreparable way, indicating a state actor. Barracuda advises customers to rotate any credentials connected to the appliance(s) and check for signs of compromise dating back to at least October 2022.

via Krebs on Security|

#barracuda-networks #cybersecurity #email-security-gateway