Attackers exploit Barracuda ESG flaws to gain root access
Barracuda says a small number of customers were hit after patches for CVE-2026-116606 and CVE-2026-111560 shipped a week earlier.
Stories per day · 30 days
36 RSS
Relatedbarracuda13fortinet11cwe-7810kev9authorization-bypass7email-security-gateway7cisa6collabora6fortimanager6rce6siteguard6waf6authentication-bypass5fortianalyzer5fortimail5nextcloud5windows5cve-2026-1104474
155 stories, newest first · one card per story
Stories tagged #command-injection
FortiAnalyzer and FortiManager HA plugin command injection scores 7.2
An authenticated attacker can run unauthorized commands by sending a crafted HTTP request to the system-ha plugin.
Unauthenticated FortiMail command injection rated CVSS 9.8
Crafted HA join-request packets can run unauthorized commands; no CVE or versions are named.
Dokploy v0.31.0 password change yields host RCE via backtick
A member changing a database password can reach host command execution; the researcher live-tested the official v0.31.0 image.
UnrealIRCd 6.2.7.1 released with hot-patch for label tag escaping bug (CVE-2026-114713)
The escaping bug allows injecting arbitrary commands into IRC server traffic using the label message tag.
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
Patching required for chained authentication bypass and command injection flaws in Barracuda products.
SolarWinds Dameware command injection flaw could allow remote system compromise
Critical CVE-2026-28336 in SolarWinds Dameware allows attackers to take over remotely controlled computers.
Barracuda discloses authorization bypass and command injection flaws
Barracuda patched CVE-2026-116606 and CVE-2026-111560 which together could allow root access to affected appliances when exploited with administrative interface access.
Barracuda Email Security Gateway flaws expose devices to root compromise
CVE-2026-116606 and CVE-2026-111560 could enable root access on ESG appliances.
2
SolarWinds Dameware command injection lets authenticated attackers take control
SolarWinds Dameware 2026.3 command injection vulnerability allows remote compromise; fixed in 2026.3.1.
Barracuda security appliances hit by two critical vulnerabilities
Patches released for CVE-2026-116606 authorization bypass and CVE-2026-111560 command injection in Barracuda Email Security Gateway and other products.
1
Barracuda flaws chained to bypass authorization and gain root access
Chaining the two vulnerabilities allows root access if the admin interface is accessible; restrict admin exposure to internal networks and update firmware.
Barracuda products have pre-auth bypass and command injection flaws
Six Barracuda gateways and management products below stated builds are affected; the Cyber Centre says updates are available.
Hackers target 61 GitHub repos with command injection
Coordinated attack on 61 repositories used command injection in GitHub Actions to steal CI/CD secrets; 83 malicious issues and PRs identified.
1
HTTP::Session for Perl vulnerable to memcached command injection
Affects versions before 0.54; no fixed version or exploitation stated.
Raritan PX3 PDU 4.3.14 diagnostics allow command injection
A low-privilege authenticated diagnostics request can run OS commands in the web-service context.
Moxa MAR-2000 firmware ping condition allows command injection
A saved monitoring field is reused by a scheduled ping thread for recurring command execution.
Ultralytics torch_safe_load command injection enables remote code execution
ZDI-26-814 is an unpatched CVSS 7.8 flaw that needs a user to open a file or visit a page.
Airflow SSH provider before 7.0.1 runs environment values as shell
SSHRemoteJobOperator quotes templated environment values only once inside an already-quoted wrapper, so $(...) runs remotely.
POSIX wordexp(3) can execute shell commands on untrusted input
musl and macOS libc can still treat some patterns as command substitutions even when WRDE_NOCMD is set.
HPE patches critical Aruba AOS flaws that can fully control devices
Eight CVEs score CVSS 10.0; unauthenticated AOS-8 flaws can run commands as root, and HPE knew of no public exploit code.
Okta Access Gateway before 2026.10.2 allows admin command execution
CVE-2026-115547 is scored 9.1 but needs Admin Console privileges, and the advisory reports no known exploitation.
1
CISA lists exploited Collabora Online command injection in KEV
CVE-2026-110447 in Collabora Online's built-in CODE Server is actively exploited; FCEB agencies must prioritize fixes.
CISA lists exploited Collabora CODE Server command injection
Versions before 26.4.303 allow remote code execution when the built-in CODE server is not running.