NewsThe Hacker News
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
Linked advisories
- CVE-2026-116606Barracuda Email Security Gateway (ESG): Umgehung der Authentifizierung über alternativen Pfad
- CVE-2026-116606Barracuda Networks Email Security Gateway und Web Application Firewall: Mehrere Schwachstellen
- CVE-2026-116606Barracuda fixes pre-auth authorization bypass and command injection that can yield root
- CVE-2026-116606Barracuda Email Security Gateway (ESG): Umgehung der Authentifizierung über alternativen Pfad
Affected vendors and products
More on Demonstrate
Other advisories
- Not ratedosv:CLEANSTART-2024-DK66902As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation
- MediumCVE-2010-4052Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.
- Not ratedosv:ECHO-ad9e-483b-55eeThis is disputed because there is no scenario in which the vulnerability was demonstrated. https://security-tracker.debian.org/tracker/CVE-2023-45913
- Not ratedosv:ECHO-6b81-2d6c-ee97This vulnerability is disputed because there is no scenario in which the vulnerability was demonstrated. https://security-tracker.debian.org/tracker/CVE-2023-45931
- HighCVE-2026-42615GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.
- Not ratedosv:ECHO-3041-f7d2-3868Upstream does not consider this a bug underlying in OpenSSH and does not intent to address it in OpenSSH. Additionally, this attack was not demonstrated against stock OpenSSH, and has never been demonstrated to be exploitable in a real software configuration. https://security-tracker.debian.org/tracker/CVE-2023-51767 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059393 https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1
- Not ratedosv:JLSEC-2025-251The TIFFFdOpen function in `tif_unix.c` in LibTIFF 4.0.10 has a memory leak, as demonstrated by...
- Not ratedosv:JLSEC-2025-214Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an...
Other news entries
- Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate AuthoritiesNewsCisco PSIRT
- OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox CommunicationNewsThe Hacker News
- Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli DataNewsThe Hacker News
- Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory BugNewsThe Hacker News
- Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host MemoryNewsThe Hacker News
- curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code ExecutionNewsThe Hacker News
- Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2OwnNewsThe Hacker News
- Proactive Defense: Hardening Code Pipelines and CI/CD InfrastructureNewsGoogle Threat Intelligence
Source: https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html
ID