[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (Barracuda Trust Center / Campus advisories, Nov 2); no exploitation reported, not in CISA KEV as of catalog 2026.10.30

Barracuda patches an Email Security Gateway auth bypass (CVE-2026-116606) that chains with a root command injection (CVE-2026-111560) shared by ESG, ADC, WAF, WSG, Message Archiver and WAF Control Center

  • CVE-2026-116606 (ESG only, CVSS 4.0 9.3 per the CVE record): pre-authentication authorization bypass. Third-party write-ups citing the CVE record say it lets an unauthenticated attacker invoke the configuration-import function and restore a crafted backup.
  • CVE-2026-111560 (CVSS 4.0 8.6): OS command injection via the timezone configuration field, executed as root. Affects Email Security Gateway, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center.
  • Barracuda's framing: exploitation requires access to the administrative interface; combined, the two bugs bypass authorization controls and yield root.
  • Fix: ESG firmware 9.4.0.029 or later per Barracuda's Campus article (the CVE record lists the bypass as fixed in 9.4.0.030, so going to the newest build available is the safe choice). ADC, WAF, WSG, BMA and WCC receive product-specific patches; on ADC 6.4 through 6.6.0.009 the patch installs automatically if automatic firmware patches are enabled.

What to do: confirm each appliance's installed firmware under Advanced > Firmware Update, apply the patches, and make sure admin interfaces are not reachable from the internet. Barracuda ESG has a history of being targeted by state actors (the 2023 CVE-2023-2868 campaign), so exposed admin panels deserve a look now even though no exploitation is reported.

Sources: Barracuda Campus: Security Updates Available for Certain Barracuda Products (Nov 2) · Barracuda Campus: ESG pre-auth authorization bypass and command injection · Barracuda Campus: Load Balancer ADC command injection · SecurityOnline write-up (Nov 2)