root@ransomvault:~$ tail -f threat_intel.log

RANSOMVAULT

Topics

Patch10Threat Intelligence8Vulnerability7Ransomware3Zero-Day3Malware1Knowledge1
Subscribe to the newsletter →

Vulnerability/Patch

Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products - Updates Available

Darkintel Team2 min read

Barracuda has identified two vulnerabilities affecting certain Barracuda products: a pre-authentication authorization bypass vulnerability and a command injection vulnerability. The vulnerabilities have been assigned CVE-2026-116606 and CVE-2026-111560, respectively.

Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device.

Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products. We have identified exploitation activity affecting a small number of organizations.

Customers should review the affected products and remediation guidance below, ensure their systems are running the latest firmware version, and have all security patches applied.

Affected Products and Remediation The following Barracuda products are affected by CVE-2026-116606 and/or CVE-2026-111560.

Administrative Access - Organizations whose administrative interfaces are not publicly accessible from the internet are less exposed to this attack path. Barracuda recommends restricting access to administrative interfaces to trusted internal networks and using appropriate network access controls to limit exposure.

Firmware - Customers using these products should verify that their systems are running the latest firmware versions and have received all security patches. The device will show the latest firmware version available.

If firmware on a device is multiple versions out of date, customers may need to perform more than one update. Contact Barracuda Support for assistance.

Patches - If a patch has not been automatically applied, customers should manually apply the appropriate patch as soon as possible. If customers have turned off automatic patching, Barracuda recommends setting devices to automatically receive patches.

Guidance on how to manually apply the patch or update firmware can be found on Barracuda Campus. Customers who require assistance verifying their firmware version or applying the appropriate security patch should contact Barracuda Support at support@barracuda.com.

Security Advisory Information

CVE: CVE-2026-116606Vulnerability Type: Pre-Authentication Authorization BypassAffected Product: ESG Severity: High CVSS Score: 9.3 Authentication Required: No (Administrative UI Access Required) Remediation: Upgrade to the latest firmware version Advisory Published: November 2, 2026 Advisory Updated: November 2, 2026

CVE: CVE-2026-111560 Vulnerability Type: Command Injection Affected Products: ESG, ADC, BMA, WCC, WAF, WSG Severity: High CVSS Score: 8.6 Authentication Required: Yes (Administrative Access) Remediation: Upgrade to the latest firmware versions Advisory Published: November 2, 2026 Advisory Updated: November 2, 2026.

ShareXLinkedInReddit

Newsletter

Get the latest cyber news in your inbox

Ransomware, breaches and exploited vulnerabilities, delivered by RansomVault.

Free. No spam. Unsubscribe in one click.

Latest news

How PHP2Shell Works, and Why It Gives Attackers Access Before Your Code Even Runs

Knowledge

PHP2Shell, the pair of critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, has become one of the most heavily exploited bugs of the year. It was exploited four days before PHP released patches on October 21, added to CISA’s Known Exploited Vulnerabilities catalog, and most recently used to break into Check Point Security Gateways and wipe VMware ESXi hosts. But how does it actually work? This post explains the vulnerability in plain terms, using technical research on th

FAA Grounds All U.S. Flights Over Nationwide Air Traffic Control Communications Failure

Threat Intelligence

On Friday afternoon, the Federal Aviation Administration (FAA) ordered a nationwide ground stop at every U.S. airport, citing "extraordinary circumstances" and safety concerns. U.S. Transportation Secretary Sean Duffy said a communications problem was affecting all Air Route Traffic Control Centers across the country. "FAA technicians are investigating the issue. We will provide immediate updates as we have them," Duffy wrote on X. Departing flights must stay on the ground until further noti

PHP2Shell Attacks on Check Point Gateways Deploy Data Wiper on VMware ESXi Hosts

Zero-Day / Threat Intelligence

Threat actors are exploiting vulnerable Check Point Security Gateways in a campaign that ends with data-wiping malware on VMware ESXi hosts. According to Check Point Research, the attacks began on October 30, 2026, first against Israeli organizations. A single actor ran the whole operation, from initial access to lateral movement and destruction. Background: PHP2Shell PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remo