{"id":10294,"date":"2026-11-04T04:23:10","date_gmt":"2026-11-04T04:23:10","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10294"},"modified":"2026-11-04T04:23:10","modified_gmt":"2026-11-04T04:23:10","slug":"barracudas-security-appliances-have-a-security-problem-of-their-own","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10294","title":{"rendered":"Barracuda\u2019s security appliances have a security problem of their own"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Barracuda, which offers a wide variety of cybersecurity devices, has been bitten by a bug itself.<\/p>\n

The company has disclosed two critical and high-severity vulnerabilities that, if chained together, could allow threat actors to bypass authorization controls and gain root access to devices.<\/p>\n

They consist of a pre-authentication authorization bypass vulnerability, tracked as CVE-2026-116606<\/a> (rated a critical 9.3 severity on the common vulnerability scoring system), and a command injection vulnerability tracked as CVE-2026-111560<\/a> (rated an 8.6 high-severity on CVSS). Attackers need to have access to the admin interface of a susceptible device to successfully exploit these vulnerabilities.<\/p>\n

Barracuda has released security patches, which it advises customers to apply immediately.<\/p>\n

The vulnerabilities impact numerous popular Barracuda products<\/h2>\n

Root access on an email gateway puts the attacker in the place that every inbound and outbound message passes, said Frank Dickson<\/a> of Dickson Research. It may also expose the credentials and connections the gateway uses to reach the mail server and directory. \u201cThose are the keys to the kingdom, if you will,\u201d he said.<\/p>\n

CVE-2026-116606 and CVE-2026-111560 both impact Barracuda\u2019s Email Security Gateway (ESG), but CVE-2026-111560 also impacts its Web Security Gateway (WSG), Web Application Firewall (WAF), WAF Control Center (WCC), Load Balancer Application Delivery Controller (ADC), and Message Archiver (BMA), the company said.<\/p>\n

Customers using these products should verify that their systems are running the latest firmware versions and have received all security patches, it advised. The device<\/a> will show the latest firmware version available; if a device\u2019s firmware is multiple versions out of date, users may need to perform several updates.<\/p>\n

Enterprises whose appliances\u2019 admin interfaces are not publicly accessible from the web are less exposed, Barracuda said; the company advised restricting access to these interfaces to trusted internal networks and applying appropriate network access controls to limit exposure.<\/p>\n

\u201cThe biggest concern is how these two vulnerabilities could chain together,\u201d said Jon Nelson<\/a>, principal advisory director at Infotech, noting that an attacker who can bypass authentication and then exploit command injection could move from accessing an exposed appliance to executing commands on it. \u201cAssessing each vulnerability in isolation can understate the risk,\u201d he said.<\/p>\n

Dickson added that security leaders<\/a> should read the advisory<\/a> closely, as it calls one flaw \u201cpre-authentication,\u201d then lists \u201cAuthentication Required: Yes, administrative access.\u201d<\/p>\n

\u201cBoth cannot be true in the usual sense,\u201d he pointed out. Likely access here means being able to reach the admin interface over the network, without a password.<\/p>\n

\u201cIf your admin interface faces the internet, that condition is already met,\u201d Dickson said.<\/p>\n

The advisory also labels a 9.3 severity rating as \u201chigh,\u201d when 9.0 and above is actually \u201ccritical\u201d on the standard scale, he pointed out. \u201cThese are small things, but labels drive patching queues,\u201d he noted. Also, the advisory does not say whether these flaws are currently being exploited, but it does not say they are not, either.<\/p>\n

How enterprises should respond<\/h2>\n

\u201cGet the admin interface off the internet,\u201d Dickson emphasized, noting that, as a cybersecurity consultant, he gives that advice at least a handful of times a week. \u201cManagement interfaces on edge devices are continually a source of vulnerability<\/a>.\u201d<\/p>\n

Once teams limit admin access to a trusted internal network or a dedicated management network, Dickson advised, they should then \u201cverify the patch rather than assume it was properly installed.\u201d From there, he said, analyze for unauthorized visitors by reviewing admin logs, check for unfamiliar accounts, and look for unexpected outbound connections from the device.<\/p>\n

History matters here, he added. In 2023, after a zero-day on this same email security gateway (ESG), Barracuda told customers with compromised appliances to replace them outright rather than rely on the patch. As he put it: \u201cA patch fixes the lock. It does not tell you who already has a key.\u201d<\/p>\n

Nelson agreed that enterprises should look closely at who can reach their administrative interfaces. They should, in addition, put access behind additional controls such as a properly configured zero trust access layer.<\/p>\n

\u201cExposing those interfaces directly to the internet was always a bad idea,\u201d he said. \u201cAs AI makes it easier to find weaknesses and chain attacks together, that exposure becomes increasingly difficult to justify.\u201d AI is also expanding the search for software flaws to include issues such as business logic weaknesses where an application can be made to bypass its intended controls. Authentication and authorization bypasses<\/a> deserve particular attention in that context, Nelson said.<\/p>\n

As more vendors use advanced AI to examine their code, CISOs should prepare for more flaw disclosures and potentially shorter windows to respond to them, he noted. \u201cThat means identifying exposed appliances, restricting access, and having a response plan ready before the next zero day arrives,\u201d he said.<\/p>\n

Understanding what each appliance exposes<\/h2>\n

Security appliances are increasingly creating vulnerabilities in corporate networks, which is changing the cybersecurity discussion. Enterprises rely on them to protect the network, yet ultimately they are software systems with vulnerabilities of their own.<\/p>\n

\u201cThey sit exactly where attackers want to be,\u201d Dickson noted.<\/p>\n

Firewalls, VPNs, and email gateways face the internet by design; that is their job, he said. They see sensitive traffic and hold credentials. Most cannot run the endpoint detection tools that protect laptops and servers, so a compromise can remain undetected for a long time, and every customer runs the same firmware, so one working exploit can scale to thousands of organizations.<\/p>\n

\u201cThe discussion is shifting from which box to buy to what the box itself exposes,\u201d Dickson said. \u201cEvery appliance purchase is a decision to trust a vendor\u2019s code at the most exposed point in the network.\u201d It deserves the same scrutiny as any other in an enterprise, he noted.<\/p>\n

Buyers should ask their vendors four questions, he advised: Is the admin interface exposed to the internet by default; how quickly do patches ship; are they applied automatically; and what logging can users see?<\/p>\n

\u201cThe security appliance does not just protect the perimeter,\u201d Dickson pointed out. \u201cIt is the perimeter, and it should be treated as the most attacked system an organization owns, because it is.\u201d<\/p>\n

\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Barracuda, which offers a wide variety of cybersecurity devices, has been bitten by a bug itself. The company has disclosed two critical and high-severity vulnerabilities that, if chained together, could allow threat actors to bypass authorization controls and gain root access to devices. They consist of a pre-authentication authorization bypass vulnerability, tracked as CVE-2026-116606 (rated […]<\/p>\n","protected":false},"author":0,"featured_media":10295,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10294","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10294"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10294"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10294\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10295"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10294"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10294"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10294"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}