Barracuda confirms active exploitation of ESG flaws for root access
CVE-2026-116606 and CVE-2026-111560 can chain to root if the admin interface is reachable; few organizations were hit.
Stories per day · 30 days
5 RSS
Relatedbarracuda8command-injection7fortinet6cwe-6395email-security-gateway5privilege-escalation5consul3fortimail3fortimanager3hashicorp3root-access3aspera-faspex2esg2kubernetes2multi-tenant2veeam2account-takeover1acl1
55 stories, newest first · one card per story
Stories tagged #authorization-bypass
CISA says IBM Faspex and FreeSWITCH flaws are exploited in attacks
Agencies must patch CVE-2026-123218 and CVE-2026-116779 within three days; GPUStack and SSHole are also listed as exploited.
1
IBM Aspera Faspex flaw listed as exploited, grants full admin rights
CVE-2026-123218 affects Faspex 5.0.0 through 5.0.19; IBM’s fix is 5.0.19 PL1, with a claimed November 12 deadline.
FortiMail flaw lets unauthenticated attackers take over IBE accounts
Fortinet rates the IBE account-takeover issue CVSS 9.1; the notice gives no versions, fix, or exploitation status.
Cisco ISE Authorization Bypass Allows Endpoint Certificate Acquisition
Cisco released software updates for ISE and ISE-PIC to address the authorization bypass.
Barracuda discloses authorization bypass and command injection flaws
Barracuda patched CVE-2026-116606 and CVE-2026-111560 which together could allow root access to affected appliances when exploited with administrative interface access.
Barracuda Email Security Gateway flaws expose devices to root compromise
CVE-2026-116606 and CVE-2026-111560 could enable root access on ESG appliances.
2
Barracuda security appliances hit by two critical vulnerabilities
Patches released for CVE-2026-116606 authorization bypass and CVE-2026-111560 command injection in Barracuda Email Security Gateway and other products.
1
Barracuda flaws chained to bypass authorization and gain root access
Chaining the two vulnerabilities allows root access if the admin interface is accessible; restrict admin exposure to internal networks and update firmware.
Apache Syncope authorization bypass through User-Controlled key (CVE-2026-113511)
Delegated administrators can bypass Realm update boundaries without destination permission.
Barracuda products have pre-auth bypass and command injection flaws
Six Barracuda gateways and management products below stated builds are affected; the Cyber Centre says updates are available.
Drupal Commerce Core authorization bypass actively exploited
CVE-2026-118539 affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13; Drupal says to upgrade to 8.x-2.41 or 3.3.13.
1
Veeam patches critical Backup & Replication authorization bypass
Unauthenticated attackers can bypass CDP Coordinator checks; fixed builds are 13.1.2.57 and 13.0.3.63, with no exploitation reported.
Veeam patches critical unauthenticated authorization bypass in Backup & Replication
CVE-2026-108142 hits 13.0 and 13.1 branches; fixes are 13.0.3.63 and 13.1.2.57, and 12.x is unaffected.
4
HashiCorp patches Consul-k8s cross-namespace ACL bypass (CVE-2026-110720)
Versions 0.42.0 through 2.0.4 are affected only with system ACL management on; fixes are 1.8.18 and 2.1.0.
consul-k8s ACL flaw can grant elevated Consul privileges (CVE-2026-110720)
An attacker must already create a ServiceAccount in another namespace and reach the Consul API; active exploitation is not confirmed.
HashiCorp Consul auth bypass in service mesh leaf certificate API
Canada’s Cyber Centre urges admins to apply HashiCorp updates for Consul and Consul Enterprise as they become available.
Apache Vysper authorization bypass lets users compromise accounts
Every Vysper version lacks an XEP-0077 authentication check; Apache rates it important at CVSS 8.8 and unsupported when assigned.
HAPI FHIR flaws allow cross-tenant reads, writes and gzip exhaustion
CISA issued four CVEs and CSAF advisory VA-26-294-01; a researcher reproduced all four on HAPI FHIR 8.10.0.
CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content
Apache Answer through 2.0.2 lets unauthorized users read or change reaction metadata on restricted content.
VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration
CERT/CC says Lowcoder 2.4.10 lets admins or developers read and run other tenants' library queries.
3
Elastic Patches 14 Security Flaws, Including One Enabling Cross-Tenant Data Interception
Elastic patched 14 flaws, including a Kibana bypass that can intercept another tenant's data.
8
CVE-2026-66082: Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）
DolphinScheduler before 3.4.3 allows cross-project changes to schedules, workflows, and task instances.
[OSSN-0109] Cross-project metric association bypass in Gnocchi
OpenStack Gnocchi lets authenticated users attach metrics to other projects' resources, bypassing authorization checks.