[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fepicCCX6lw-EWpoMpETlcSgCjhQnD4c0c5ejdIKuqX8":3},{"article":4,"iocs":48,"watch_terms":68,"solutions":69,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"030b36df-26fc-4518-bb93-c9929c2bfb8b","Barracuda warns of critical flaws allowing root access to devices","barracuda-warns-of-critical-flaws-allowing-root-access-to-devices-7a78f5","Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges. [...]","Barracuda Networks disclosed two critical vulnerabilities affecting multiple products, including CVE-2026-116606 in Email Security Gateway that stems from authentication weakness, and CVE-2026-111560 allowing OS command injection as root. Successful exploitation requires access to administrative interfaces; Barracuda has released security patches for affected devices including ESG, Load Balancer ADC, Message Archiver, WAF Control Center, and Web Security Gateway. The disclosure comes three years after UNC4841 exploited similar Barracuda ESG flaws in zero-day attacks targeting government agencies and deploying SeaSpy and Saltwater malware.","Barracuda Networks warns of critical flaws allowing root access to Email Security Gateway and other devices.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fbarracuda-warns-of-critical-flaws-allowing-root-access-to-devices\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F03\u002FBarracuda.jpg","2026-11-03T15:06:16+00:00","2026-11-03T16:00:13.505836+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"Barracuda Networks","vendor",{"name":21,"type":22},"Email Security Gateway (ESG)","product",{"name":24,"type":22},"Load Balancer ADC",{"name":26,"type":22},"Web Application Firewall (WAF)",{"name":28,"type":29},"UNC4841","threat_actor",{"name":31,"type":19},"Mandiant","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,56,59,62,66],{"type":50,"value":51,"context":52},"cve","CVE-2026-116606","Critical authentication weakness in Barracuda Email Security Gateway allowing configuration modification",{"type":50,"value":54,"context":55},"CVE-2026-111560","OS command injection vulnerability affecting multiple Barracuda products allowing root code execution",{"type":50,"value":57,"context":58},"CVE-2023-7102","Barracuda ESG zero-day exploited by UNC4841 for arbitrary code execution (patched 2023)",{"type":50,"value":60,"context":61},"CVE-2023-2868","Barracuda ESG zero-day exploited by UNC4841 for cyber-espionage and malware deployment (patched 2023)",{"type":63,"value":64,"context":65},"malware","SeaSpy","Previously unknown malware deployed by UNC4841 via CVE-2023-2868 exploitation",{"type":63,"value":67,"context":65},"Saltwater",[18,31,21],{"controls":70,"vendors":158},[71,100,129],{"slug":72,"name":73,"problem":74,"products":75},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":101,"name":102,"problem":103,"products":104},"patch-management","Automated patch management","Known holes get closed in days, not months.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":130,"name":131,"problem":132,"products":133},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[134,142,150],{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[],{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":171},"barracuda-critical-flaws-enable-root-access-patch-immediately","Barracuda Critical Flaws Enable Root Access — Patch Immediately","Two critical vulnerabilities in Barracuda's security appliances — an authentication bypass and an OS command injection flaw — allow attackers to gain root-level access to devices that should themselves be protecting networks. This mirrors a 2021 incident where UNC4841 exploited nearly identical Barracuda ESG weaknesses in state-sponsored attacks against government agencies, demonstrating that lessons were not fully operationalized. The severity is compounded by the fact that these are security appliances: compromising them can give attackers a privileged vantage point inside the network perimeter. Organisations that delay patching network-edge security devices face the highest risk, as these devices are often internet-facing and trusted by downstream systems. Prompt patching, strict administrative access controls, and continuous monitoring of these appliances are essential to preventing exploitation.",[164,165,166,167,168,169,170],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":172,"MITRE ATT&CK T1566: Phishing":173,"NIST SP 800-53 SI-2: Flaw Remediation":174,"OWASP A06:2021 Vulnerable and Outdated Components":175,"CIS Control 7: Continuous Vulnerability Management":176,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":177,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":178},"NIS2 requires essential and important entities to implement incident handling and vulnerability management policies — the repeated exploitation of Barracuda ESG appliances signals a failure to operationalise these obligations.","While not phishing-specific, the prior UNC4841 campaign used initial access via appliance exploitation to deploy persistent malware; tracking ATT&CK techniques associated with this threat group informs detection rules that should be active on Barracuda devices now.","SI-2 requires organisations to identify, report, and correct information system flaws in a timely manner — directly mandating the prompt application of the Barracuda patches to prevent root-level exploitation.","Both vulnerabilities exist in unpatched versions of Barracuda components; OWASP A06 specifically addresses the risk of running software with known, unpatched vulnerabilities in production environments.","Regular vulnerability scanning and a disciplined patching cadence for internet-facing appliances would have ensured Barracuda's patches were applied before attackers could exploit these critical flaws.","This control requires timely identification and remediation of technical vulnerabilities in information systems, which would have driven patching of the affected Barracuda appliances before exploitation.","The authentication weakness at the heart of CVE-2026-116606 highlights the need for robust authentication controls on administrative interfaces, as called for by this CSF outcome."]