[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsMG5U-Dupv7T0Pjp3fkThhsGMXiplnO43yZb20jX5Hw":3},{"article":4,"iocs":42,"watch_terms":50,"solutions":51,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"68728520-1d9b-406e-a2e3-cc82ec7646ea","Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login","experts-demonstrate-barracuda-email-security-gateway-chain-enabling-root-access-985aa6","Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a","Two critical vulnerabilities in Barracuda's Email Security Gateway (ESG) have been detailed by watchTowr, allowing unauthenticated attackers to gain root-level access. The flaws, CVE-2026-116606 (authorization bypass) and CVE-2026-111560 (command injection), can be chained together to execute commands with the highest level of privilege without requiring any login credentials. Barracuda has released patches for the affected products.","Two Barracuda ESG flaws chained for root access without login; patches released.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fexperts-demonstrate-barracuda-email.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh59LXthjD6N50867w2v7T4JyVUCOlVAmz1MJcZHKBFFaSnKDabB0FmdedrbvWRkp9XONe9Pz2RV1MQ-9QpJ8d85XE3w54EmMLKgaf1ygKD2e0y2X9mA7VsfyyB-8l1KFi-F5Gj9Q2vdsusmAl2khvXHNyOzWB_l7bj6NkOHkUgDYW-vENOowt0L8qM4kM\u002Fs1600\u002Fbar.jpg","2026-11-06T05:39:10+00:00","2026-11-06T08:00:20.617358+00:00",9,[17,20,23,26],{"name":18,"type":19},"Email Security Gateway","product",{"name":21,"type":22},"Barracuda","vendor",{"name":24,"type":25},"email-filtering","technology",{"name":27,"type":28},"UNC4841","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,37],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[43,47],{"type":44,"value":45,"context":46},"cve","CVE-2026-116606","Authorization bypass vulnerability in Barracuda ESG.",{"type":44,"value":48,"context":49},"CVE-2026-111560","Command injection vulnerability in Barracuda ESG.",[21,18],{"controls":52,"vendors":136},[53,82,107],{"slug":54,"name":55,"problem":56,"products":57},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":83,"name":84,"problem":85,"products":86},"patch-management","Automated patch management","Known holes get closed in days, not months.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":83,"product_name":104,"url":105,"description":106},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":108,"name":109,"problem":110,"products":111},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","next-generation-firewall","Next-Generation Firewalls","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fnetwork-security\u002Fnext-generation-firewall","Hardware, virtual and cloud firewalls running PAN-OS, with intrusion prevention.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"sonicwall","SonicWall","\u002Fvendor-logos\u002Fsonicwall.png","sonicwall-firewalls","SonicWall firewalls","https:\u002F\u002Fwww.sonicwall.com\u002Fproducts\u002Ffirewalls","Next-generation firewalls for small business to enterprise.",[137],{"slug":138,"name":139,"logo_path":140,"roles":141},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png",[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":155},"chained-barracuda-esg-flaws-grant-root-access-without-login","Chained Barracuda ESG Flaws Grant Root Access Without Login","Two critical vulnerabilities in Barracuda's Email Security Gateway — an authorization bypass and a command injection flaw — were chained together to allow unauthenticated attackers to achieve root-level access, representing one of the most severe possible attack outcomes. The root cause lies in insufficient input validation and broken access control within a perimeter security appliance that organizations inherently trust and expose to the internet. This is particularly dangerous because the device is designed to protect email infrastructure, meaning compromise could expose sensitive communications, enable lateral movement, and undermine the entire security perimeter. The fact that patches were released underscores how timely vulnerability management and patching cycles are essential for internet-facing security appliances, which are high-value targets for threat actors.",[148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":156,"PCI DSS Requirement 6":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"OWASP A06:2021 Vulnerable and Outdated Components":159,"CIS Control 7: Continuous Vulnerability Management":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":162},"NIS2 mandates incident handling and vulnerability management practices for essential entities; the exposure of a perimeter email security device to unauthenticated root compromise highlights a gap in the security hygiene obligations NIS2 enforces.","PCI DSS Requirement 6 mandates the development and maintenance of secure systems, including timely patching of known vulnerabilities; email gateways handling cardholder-adjacent communications must be kept current under this requirement.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes — a formal flaw remediation process would have ensured the Barracuda patches were applied promptly after release.","The chained exploit leveraged unpatched components in a production security appliance, directly illustrating the risk OWASP A06 highlights around failing to track, assess, and update vulnerable software components.","Regular authenticated scanning of internet-facing appliances would have flagged the unpatched ESG vulnerabilities, enabling remediation before attackers could exploit the authorization bypass and command injection chain.","This control requires timely identification and remediation of technical vulnerabilities in information systems; applying it to internet-facing email gateways would have driven patch application before the exploit chain could be weaponized.","The authorization bypass vulnerability allowed unauthenticated root access, which a robust access control posture — including enforcing authentication on all administrative functions — would have prevented or significantly limited."]