Attackers exploit Barracuda ESG flaws to gain root access
Barracuda says a small number of customers were hit after patches for CVE-2026-116606 and CVE-2026-111560 shipped a week earlier.
Stories per day · 30 days
3 RSS
Relatedcommand-injection13authorization-bypass8email-security-gateway8esg6root-access6authentication-bypass4cisa-kev3email-security3bod-26-042kev2outlook2rce2skills-gap2admin-ui1ai-adoption1ai-risks1automation1chromium1
21 stories, newest first · one card per story
Stories tagged #barracuda
Microsoft Patch Tuesday discloses 1,093 bugs, including exploited Outlook flaw
CISA ordered agencies to patch exploited Outlook, Barracuda and other bugs, with Outlook due by month’s end.
CISA adds six exploited vulnerabilities to its KEV catalog
Entries cover Cisco BroadWorks, Barracuda products, Outlook, and Chromium; FCEB agencies must prioritize them under BOD 26-04.
Barracuda MSP report notes AI and recovery concerns
Prospective MSP customers show less confidence in threat detection than existing users
Barracuda Email Security Gateway Pre-Auth RCE disclosed
The advisory mentions CVE-2026-116606 and CVE-2026-111560 for Barracuda Email Security Gateway.
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
Patching required for chained authentication bypass and command injection flaws in Barracuda products.
Barracuda discloses authorization bypass and command injection flaws
Barracuda patched CVE-2026-116606 and CVE-2026-111560 which together could allow root access to affected appliances when exploited with administrative interface access.
Barracuda Email Security Gateway flaws expose devices to root compromise
CVE-2026-116606 and CVE-2026-111560 could enable root access on ESG appliances.
2
Barracuda security appliances hit by two critical vulnerabilities
Patches released for CVE-2026-116606 authorization bypass and CVE-2026-111560 command injection in Barracuda Email Security Gateway and other products.
1
Barracuda flaws chained to bypass authorization and gain root access
Chaining the two vulnerabilities allows root access if the admin interface is accessible; restrict admin exposure to internal networks and update firmware.
Barracuda critical flaws allow root access to devices
Two critical vulnerabilities in Barracuda ESG and related products could enable root access; patches released for affected versions.
Security leaders report AI and identity threats straining cybersecurity teams
67% of security leaders say their teams struggle to meet business needs due to AI risks and identity-based attacks.
1
Barracuda products have pre-auth bypass and command injection flaws
Six Barracuda gateways and management products below stated builds are affected; the Cyber Centre says updates are available.
Barracuda survey finds AI-linked cuts at junior and senior security levels
56% of respondents reported AI-linked workforce reductions, split evenly between entry-level and higher-level roles.
1
Fake CAPTCHAs are tricking users into running malware on their own devices
Barracuda found fake CAPTCHAs in 43% of 2025 phishing-kit attacks, including ClickFix malware lures.
3
Phishing emails are baiting your AI assistant
Phishing emails hide prompt injections that try to make AI inbox assistants endorse fraudulent payment changes.
6
Attackers Hide AI Prompt Injections Inside Phishing Emails
Barracuda found phishing emails hiding prompt injections aimed at AI inbox assistants and human recipients.
2
Barracuda brings AI security and governance within reach of smaller organizations
Barracuda Networks launched an AI security and governance platform aimed at helping smaller organizations securely adopt generative AI tools.
1
New Phishing Attack Uses Blob URLs to Hide Malicious Pages From Security Scanners
Barracuda detailed a DocuSign-themed phishing campaign that renders credential-harvesting pages as browser blob URLs, evading URL reputation and blocklist defenses.
Cybercriminals are building phishing pages that exist only inside victims’ browsers
Barracuda details a DocuSign-themed phishing campaign that renders login pages locally via blob URLs, abusing genuine Microsoft OAuth and Teams infrastructure.
New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser
Barracuda details a phishing campaign that renders pages in-browser via blob URLs, routed through Microsoft Teams and cdn.bloom[.]io to evade detection.