CISA lists Barracuda ESG auth bypass in KEV (CVE-2026-116606)
An unauthenticated attacker can restore a crafted backup and change global configuration; the due date is November 13.
1
Stories per day · 30 days
2 RSS
Relatedbarracuda6command-injection4authentication-bypass3authorization-bypass2root-access2bod-26-041cisa-kev1kev1
4 stories, newest first · one card per story
Stories tagged #esg
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
Patching required for chained authentication bypass and command injection flaws in Barracuda products.
Barracuda discloses authorization bypass and command injection flaws
Barracuda patched CVE-2026-116606 and CVE-2026-111560 which together could allow root access to affected appliances when exploited with administrative interface access.
Barracuda critical flaws allow root access to devices
Two critical vulnerabilities in Barracuda ESG and related products could enable root access; patches released for affected versions.