[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fg9i27uIZ2l4m-XUQHNZtB-FYiHnnUDz6HlCt_yeaURU":3},{"article":4,"iocs":49,"watch_terms":57,"solutions":58,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"250079e6-1f96-4051-a465-c41986e75d1c","Barracuda ESG Authentication Bypass Flaw Opens Path to Root","barracuda-esg-authentication-bypass-flaw-opens-path-to-root-2765c9","An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances. The post Barracuda ESG Authentication Bypass Flaw Opens Path to Root appeared first on SecurityWeek.","Barracuda has released patches for two critical vulnerabilities in its Email Security Gateway (ESG) appliances. The flaws, CVE-2026-116606 (authentication bypass) and CVE-2026-111560 (command injection), can be chained to grant an attacker root access. The command injection flaw also affects several other Barracuda products, including ADC, Message Archiver, and WAF.","Barracuda ESG appliances vulnerable to root access via chained authentication bypass and command injection flaws.","https:\u002F\u002Fwww.securityweek.com\u002Fbarracuda-email-security-gateway-authentication-bypass-opens-path-to-root\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F08\u002FEmail-Security.jpg","2026-11-04T14:24:54+00:00","2026-11-04T15:00:05.742127+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Email Security Gateway","product",{"name":21,"type":22},"Barracuda","vendor",{"name":24,"type":19},"Load Balancer Application Delivery Controller",{"name":26,"type":19},"Message Archiver",{"name":28,"type":19},"WAF Control Center",{"name":30,"type":19},"Web Application Firewall","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54],{"type":51,"value":52,"context":53},"cve","CVE-2026-116606","Authentication bypass vulnerability in Barracuda ESG.",{"type":51,"value":55,"context":56},"CVE-2026-111560","Command injection vulnerability affecting Barracuda ESG and other products.",[21,18,24],{"controls":59,"vendors":146},[60,89,117],{"slug":61,"name":62,"problem":63,"products":64},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":90,"name":91,"problem":92,"products":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",[94,102,109],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":90,"product_name":106,"url":107,"description":108},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":118,"name":119,"problem":120,"products":121},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"sonicwall","SonicWall","\u002Fvendor-logos\u002Fsonicwall.png","sonicwall-firewalls","SonicWall firewalls","https:\u002F\u002Fwww.sonicwall.com\u002Fproducts\u002Ffirewalls","Next-generation firewalls for small business to enterprise.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","quantum-firewall","Quantum Force firewalls","https:\u002F\u002Fwww.checkpoint.com\u002Fquantum\u002Fnext-generation-firewall\u002F","Next-generation firewalls with threat prevention.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"barracuda-esg-critical-flaws-enable-root-access-via-chained-exploits","Barracuda ESG Critical Flaws Enable Root Access via Chained Exploits","Two critical vulnerabilities in Barracuda's Email Security Gateway — an authentication bypass and a command injection flaw — can be chained together to grant an unauthenticated attacker full root access to the appliance. Email security gateways sit at a highly privileged position in network infrastructure, making them high-value targets that demand immediate patching. The command injection flaw's presence across multiple Barracuda product lines (ADC, Message Archiver, WAF) demonstrates how a single unpatched vulnerability class can propagate across an entire vendor's portfolio. This incident underscores the danger of deploying internet-facing security appliances without a rigorous, rapid patch management process.",[158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":166,"PCI DSS Requirement 6":167,"NIST SP 800-53 SI-2: Flaw Remediation":168,"OWASP A06:2021 Vulnerable and Outdated Components":169,"CIS Control 7: Continuous Vulnerability Management":170,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; the multi-product scope of this flaw means operators must have coordinated processes to patch network appliances across their entire Barracuda footprint without delay.","Requirement 6 mandates that organisations protect systems and software from known vulnerabilities through patching; email gateways that process payment-related communications must be patched rapidly when critical advisories are issued.","SI-2 requires organisations to identify, report, and correct information system flaws; a mature flaw remediation process with defined timelines would have ensured patches were applied to all affected Barracuda products as soon as they were released.","The chained exploit relies on unpatched components in a widely deployed appliance; OWASP A06 specifically calls out the risk of running components with known vulnerabilities and the need for continuous monitoring of component security advisories.","Regular authenticated scanning and a defined remediation timeline would have identified the ESG and multi-product command injection flaws promptly and driven patching before exploitation could occur.","This control mandates timely identification and remediation of technical vulnerabilities; applying it to the multi-product Barracuda estate would have driven coordinated patching across ESG, ADC, WAF, and Message Archiver simultaneously.","The authentication bypass (CVE-2026-116606) succeeded because the appliance's authentication mechanism could be circumvented; this control requires that authentication be robustly enforced to prevent unauthorised access."]