Barracuda o'z mahsulotlariga ta'sir qiladigan ikkita zaiflik haqida ma'lumot e'lon qildi; ular birgalikda zanjirlangan holda hujumchiga avtorizatsiya nazoratini chetlab o'tish va zaif qurilmada root huquqini olish imkonini berishi mumkin.
Zaifliklar — autentifikatsiyadan oldingi avtorizatsiyani chetlab o'tish zaifligi va buyruq in'ektsiyasi zaifligi — mos ravishda CVE-2026-116606 (CVSS balli: 9.3) va CVE-2026-111560 (CVSS balli: 8.6) identifikatorlari bilan belgilangan.
CVE-2026-116606 faqat Email Security Gateway'ga ta'sir qilsa, CVE-2026-111560 quyidagi Barracuda mahsulotlariga ta'sir qiladi:
- Email Security Gateway
- Load Balancer Application Delivery Controller
- Message Archiver
- WAF Control Center
- Web Application Firewall
- Web Security Gateway
"Muvaffaqiyatli ekspluatatsiya hujumchidan ta'sirlangan mahsulotning ma'muriy interfeysiga kirish huquqiga ega bo'lishni talab qiladi," deb aytdi Barracuda. "Agar ular birgalikda ekspluatatsiya qilinsa, bu zaifliklar hujumchiga avtorizatsiya nazoratini chetlab o'tish va qurilmada root huquqini olish imkonini berishi mumkin."
Barracuda ma'muriy interfeyslarini internetga ochiq qilmagan tashkilotlar hujum yo'liga kamroq zaif ekanligini aytib, mijozlarga quyidagi qadamlarni bajarishni tavsiya qildi:
- Ma'muriy interfeyslarga kirishni faqat ishonchli ichki tarmoqlarga cheklang
- Ta'sirni cheklash uchun tegishli tarmoq kirish nazoratlaridan foydalaning
"Ushbu mahsulotlardan foydalanadigan mijozlar tizimlari eng so'nggi proshivka versiyalarida ishlayotganini va barcha xavfsizlik yamoqlarini olganini tekshirishlari kerak," deb qo'shimcha qildi u. "Agar qurilmadagi proshivka bir necha versiya orqada qolgan bo'lsa, mijozlar bir nechta yangilashni bajarishlari kerak bo'lishi mumkin."
Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device.
The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) and CVE-2026-111560 (CVSS score: 8.6), respectively.
While CVE-2026-116606 only affects Email Security Gateway, CVE-2026-111560 impacts the following Barracuda products -
- Email Security Gateway
- Load Balancer Application Delivery Controller
- Message Archiver
- WAF Control Center
- Web Application Firewall
- Web Security Gateway
"Successful exploitation requires an attacker to have access to the administrative interface of an affected product," Barracuda said. "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device."
Barracuda said that organizations that do not expose their administrative interfaces to the internet are less vulnerable to the attack path, urging customers to follow the steps below -
- Restrict access to administrative interfaces to trusted internal networks
- Use appropriate network access controls to limit exposure
"Customers using these products should verify that their systems are running the latest firmware versions and have received all security patches," it added. "If firmware on a device is multiple versions out of date, customers may need to perform more than one update."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.