Ethical Hacking News
Barracuda's Email Security Gateways have been hit by multiple vulnerabilities, leaving organizations vulnerable to exploitation. The vulnerabilities, identified as CVE-2026-116606 and CVE-2026-111560, pose a significant threat to the security of Barracuda's customers, particularly those with exposed devices connected to the internet. The company has released patches for affected products and is working closely with affected businesses to remediate the issues. Organizations are urged to stay vigilant and take prompt action to address these vulnerabilities.
Barracuda's Email Security Gateway (ESG) products have been hit with multiple vulnerabilities, including CVE-2026-116606 and CVE-2026-111560. The vulnerabilities allow attackers to bypass authentication requirements and gain access to administrative user interfaces. The combined effect of these vulnerabilities could lead to data theft, installation of backdoors, and full control over affected systems. Barracuda has released patches for affected products and is working with affected businesses to remediate the issues. The discovery highlights the importance of regular patching and maintenance of security software, particularly for organizations with exposed devices connected to the internet.
Barracuda, a leading provider of email security solutions, has recently faced a significant setback in the form of multiple vulnerabilities being discovered in its popular Email Security Gateway (ESG) products. The vulnerabilities, identified as CVE-2026-116606 and CVE-2026-111560, have been found to pose a significant threat to the security of Barracuda's customers, particularly those with exposed devices connected to the internet.
The CVE-2026-116606 vulnerability is a pre-authentication authorization bypass flaw that allows an attacker to bypass authentication requirements and gain access to the administrative user interface. This vulnerability has been rated at 9.3 on the CVSS (Common Vulnerability Scoring System) scale, indicating a high level of severity. The CVE-2026-111560 vulnerability, on the other hand, is a command-injection flaw that affects multiple Barracuda products, including the ESG, load balancer, message archiver, web application firewall, WAF control center, and web security gateway.
The combined effect of these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device, potentially leading to data theft, installation of backdoors, and full control over affected systems. It is worth noting that the attackers are believed to be exploiting the vulnerabilities in a targeted manner, with 27 percent of identified affected organizations being government entities.
Barracuda has taken swift action to address the vulnerabilities, releasing patches for affected products and working closely with affected businesses to remediate the issues. However, the company has declined to comment on the number of organizations that have been affected by the exploitation of these vulnerabilities.
The discovery of these vulnerabilities highlights the importance of regular patching and maintenance of security software, particularly for organizations with exposed devices connected to the internet. It also underscores the need for vigilance and prompt action in the face of emerging security threats. As one expert noted, "If your Email Security Gateway's admin UI is open to the internet, that's the first thing I'd close today."
In addition to the vulnerabilities in Barracuda's ESG products, the article also touches on the broader landscape of security threats and vulnerabilities in the industry. Other recent vulnerabilities and exploits discussed in the article include those affecting Microsoft's Azure Linux, GitLab, and Citrix's NetScaler, as well as a recent phishing attack targeting Signal users.
The article concludes by emphasizing the importance of staying informed about emerging security threats and taking prompt action to address them. As the threat landscape continues to evolve, it is crucial for organizations to stay vigilant and proactive in their efforts to protect themselves against emerging threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Barracudas-Email-Security-Gateways-Hit-by-Multiple-Vulnerabilities-Leaving-Organizations-Vulnerable-to-Exploitation-ehn.shtml
https://www.theregister.com/security/2026/11/10/barracudas-email-security-gateways-bitten-by-make-me-root-vulns/5308883
https://nvd.nist.gov/vuln/detail/CVE-2026-116606
https://www.cvedetails.com/cve/CVE-2026-116606/
https://nvd.nist.gov/vuln/detail/CVE-2026-111560
https://www.cvedetails.com/cve/CVE-2026-111560/
Published: Tue Nov 10 15:36:50 2026 by llama3.2 3B Q4_K_M
