Tag

Cve 2026 116606

All articles tagged with #cve 2026 116606

security1 day ago•10 min saved

Barracuda Patches Critical Chain Granting Unauthenticated Root Access on Email Security Gateway

Barracuda has released patches for two vulnerabilities that can be chained to achieve unauthenticated root access on its Email Security Gateway (ESG). CVE-2026-116606 is a pre-authentication authorization bypass, while CVE-2026-111560 is an OS command injection flaw. According to watchTowr Labs, the authorization bypass allows attackers to trigger backup restore functions without valid credentials. This process executes a command injection vulnerability as root, enabling arbitrary code execution. Barracuda advises customers to update firmware immediately and restrict administrative interface access to trusted internal networks.

via watchTowr Labs|

#barracuda-networks #cve-2026-111560 #cve-2026-116606

cybersecurity1 day ago

Barracuda Patches Critical Chain Granting Unauthenticated Root Access on Email Security Gateway

Barracuda released patches for two critical vulnerabilities that can be chained to achieve unauthenticated root access on its Email Security Gateway. The first flaw, CVE-2026-116606, is an authorization bypass allowing attackers to restore crafted configuration backups. The second, CVE-2026-111560, is a command injection vulnerability that executes commands as root. While the command injection affects multiple products, it typically requires administrative access; however, the authorization bypass on the Email Security Gateway circumvents this requirement. Mandiant assigned CVSS scores of 9.3 and 8.6 to the respective flaws. Security firm watchTowr detailed the attack chain, noting that a failed password change returns a low-privilege role, exposing backup-restore functions to unauthenticated users. The restored data includes a timezone value executed as a shell command. Barracuda advises applying the patch, restricting administrative interfaces to trusted networks, and re-enabling automatic patching.

via The Hacker News|

#barracuda #cve-2026-111560 #cve-2026-116606

cybersecurity4 days ago

Barracuda Discloses Critical Flaws Enabling Root Access via Chained Exploitation

Barracuda has disclosed two critical vulnerabilities, CVE-2026-116606 and CVE-2026-111560, that can be chained to bypass authorization and gain root access on its security appliances. The first flaw, a pre-authentication authorization bypass, affects only the Email Security Gateway, while the second, a command injection vulnerability, impacts a wide range of products including load balancers, web application firewalls, and message archivers. Although the command injection flaw has a CVSS score of 8.6 and the authorization bypass scores 9.3, successful exploitation requires an attacker to already have access to the administrative interface of the affected device. Barracura advises organizations to restrict administrative interface access to trusted internal networks and ensure all systems are running the latest firmware, noting that devices multiple versions behind may require multiple updates to reach a secure state.

via The Hacker News|

#authorization-bypass #barracuda #command-injection