Command injection
3 articles
CVEBarracuda
Barracuda Email Security Gateway: two new bugs chain from no login to root through the admin page (CVE-2026-116606, CVE-2026-111560)
How to fix CVE-2026-116606: upgrade Barracuda Email Security Gateway to 9.4.0.030 or later. Paired with CVE-2026-111560 it goes from no login to root through the admin web interface. Check that port 8000 is not on the internet and that Firmware Patches is not set to Disable.
HOL GuardCVEHermes agent
CVE-2026-71963: Hermes Agent runs Git config before the first prompt
How to fix CVE-2026-71963: update Hermes Agent to a build containing commit f6234d0 or a later vendor release.
HOL GuardCVETeamviewer
CVE-2026-19042: TeamViewer Linux Chat Link Command Injection (and Sibling CVE-2026-16444)
How to fix CVE-2026-19042: upgrade TeamViewer Full Client and Host for Linux to 15.81
HOL GuardRelated topics
Keep exploring
The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.