https://www.phllaps.net/tags/barracuda-networks/ Recent content in Barracuda Networks on PhllapsNET Hugo en-gb Tue, 10 Nov 2026 00:00:00 +0000 https://www.phllaps.net/posts/barracuda-networks-email-security-gateway-esg-authentication-bypass-using-an-alternate-path-or-channel-vulnera/ Tue, 10 Nov 2026 00:00:00 +0000 https://www.phllaps.net/posts/barracuda-networks-email-security-gateway-esg-authentication-bypass-using-an-alternate-path-or-channel-vulnera/ <div style="background:#b91c1c;color:white;padding:16px 18px;border-radius:14px;font-weight:800;font-size:18px;display:flex;align-items:center;gap:12px;box-shadow:0 10px 24px rgba(0,0,0,0.18);"><span style="font-size:24px;">🚨</span><span>SEVERITY: CRITICAL — CVSS 9.3</span><span style="opacity:0.95;font-weight:700;margin-left:auto;">Security Advisory</span></div> <h2 id="tldr-">TL;DR 📌</h2> <ul> <li>Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.</li> <li>Highest CVSS: <strong>9.3 (Critical)</strong>.</li> <li><strong>Listed in CISA KEV</strong> (2026-11-10) — this is being exploited in the wild.</li> <li><strong>Check the advisory for fixed releases</strong> — remediation detail is in the vendor link below.</li> <li>CVEs: CVE-2026-116606.</li> </ul> <h2 id="what-it-is">What it is</h2> <p>Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.</p> https://www.phllaps.net/posts/barracuda-networks-multiple-products-os-command-injection-vulnerability/ Tue, 10 Nov 2026 00:00:00 +0000 https://www.phllaps.net/posts/barracuda-networks-multiple-products-os-command-injection-vulnerability/ <div style="background:#dc2626;color:white;padding:16px 18px;border-radius:14px;font-weight:800;font-size:18px;display:flex;align-items:center;gap:12px;box-shadow:0 10px 24px rgba(0,0,0,0.18);"><span style="font-size:24px;">🚨</span><span>SEVERITY: HIGH — CVSS 8.6</span><span style="opacity:0.95;font-weight:700;margin-left:auto;">Security Advisory</span></div> <h2 id="tldr-">TL;DR 📌</h2> <ul> <li>Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value…</li> <li>Highest CVSS: <strong>8.6 (High)</strong>.</li> <li><strong>Listed in CISA KEV</strong> (2026-11-10) — this is being exploited in the wild.</li> <li><strong>Check the advisory for fixed releases</strong> — remediation detail is in the vendor link below.</li> <li>CVEs: CVE-2026-111560.</li> </ul> <h2 id="what-it-is">What it is</h2> <p>Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606</p>