CVE Overview for Barracuda CloudGen Firewall
Table of CVEs (CGF & SE boxes)
The following list contains all CVEs which Barracuda Networks is aware of. The table rows are listed in descending order, the sorting key is the CVE number.
Note that the most recent CVE added by Barracuda Networks does not necessarily mean that it is in the topmost row!
CVE | Short summary | Assessment | Executive Summary | Affected Versions | Ticket | Mitigation | Updates | Links |
|---|---|---|---|---|---|---|---|---|
CVE-2026-115560 | PHP Session Upload Progress RCE — unpatched vulnerability in PHP session deserialization when switching serialize_handler at runtime with upload_progress enabled | Not affected | Not affected. Requires application code that switches session.serialize_handler from php_binary or php_serialize to php at runtime before calling session_start(). Our PHP code (webui-sdwan) does not perform this serializer switch — the handler stays at the default php throughout. On standard CGF boxes php-fpm is disabled entirely. No action required. |
|
|
|
| |
CVE-2026-109619 | PHP core RCE ("php2shell" chain), CVSS 9.2 — companion to CVE-2026-109618 | Partially affected | Part of the php2shell exploit chain together with CVE-2026-109618. See BNNGF-102882 for details. | SecureEdge (T) appliances with webui-sdwan active | Set session.upload_progress.enabled = Off in /etc/php.ini (no functional impact) Download and install hotfix HF-1176. |
| ||
CVE-2026-109618 | PHP core RCE via session.upload_progress ("php2shell"), CVSS 9.2 | Partially affected | SecureEdge (T) boxes are potentially affected. The PHP-based webui-sdwan is reachable from the management LAN only. Standard CGF boxes are not affected (PHP not active). | SecureEdge (T) appliances with webui-sdwan active | Set session.upload_progress.enabled = Off in /etc/php.ini (no functional impact) Download and install hotfix HF-1176. |
| ||
CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106070, CVE-2026-106071, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074, CVE-2026-111497 | Node.js October 2026 security releases — TLS hostname bypass, DNS truncation, Brotli RCE, Permission Model bypasses, entropy caching | Not affected | CGF does not include or use Node.js. |
|
|
|
| |
CVE-2026-98432 | Linux Kernel TCP Use-After-Free — race condition in IPv4 TCP handshake where ireq_opt/inet_opt is freed without RCU grace period (kfree instead of kfree_rcu). CVSS 9.8. | Affected | Affected. CloudGen Firewall uses affected Linux kernel versions. We rate the practical severity as moderate, as MPTCP is not used throughout the entire distribution, which makes a real-world exploit significantly harder. Updates will be provided in upcoming versions. | 9.0.x, 10.0.x, 10.5.x |
| 9.0.7, 10.0.3, 10.5.2 | ||
CVE-2026-94300 | BIND 9 GSS-TSIG race condition leading to memory corruption (double free), potentially allowing remote code execution | Not affected | CGF includes BIND 9.20.18 which is in the affected version range. However, the GSS-TSIG feature required to exploit this vulnerability is not used and cannot be enabled through the CGF configuration. The vulnerable code path is not reachable. |
| No action required | Update BIND to 9.20.30 planned for next release | ||
CVE-2026-63913 | Linux kernel netfilter conntrack TCP state machine allows premature NAT entry termination via crafted RST with invalid sequence number | Not affected | CGF does not use the Linux kernel nf_conntrack module for connection tracking or NAT. ACPF implements its own session/slot system with TCP sequence validation, loose RST wait states, and guessed RST detection. RSTs with invalid sequence numbers are dropped before any state transition. |
|
|
|
| |
CVE-2026-56181 | Windows 11 24H2 Network Address Translation (NAT) origin validation error allows spoofing over adjacent network | Not affected | Windows-only vulnerability. CGF runs on Linux and does not use Windows NAT components. |
|
|
|
| |
CVE-2026-63076 | OpenSSL CMP invalid pointer dereference in protectionAlg verification | Not affected | CloudGen Firewall does not use the OpenSSL CMP (Certificate Management Protocol) functionality |
|
|
|
| |
CVE-2026-63072 | OpenSSL CMS key unwrapping heap buffer overflow (AES-WRAP-PAD) | Not affected | CloudGen Firewall does not use the OpenSSL CMS decryption functionality |
|
|
|
| |
CVE-2026-18798 | OpenSSL QUIC server double-free via malformed INITIAL packet | Not affected | CloudGen Firewall does not use the OpenSSL QUIC server implementation |
|
|
|
| |
CVE-2026-64600 | RefluXFS: Linux kernel local privilege escalation via XFS copy-on-write race condition | Not affected | All currently supported versions of CGF and SE are not affected as XFS is not used as filesystem. |
|
|
|
| |
CVE-2026-43499 | Linux kernel local privilege escalation via use-after-free in futex priority-inheritance code ("GhostLock") | Affected | All currently supported versions of CGF and SE are affected by this vulnerability. An unprivileged local user can gain root privileges and escape containers. | <= 9.0.6 | Disable shell-level access for admins | 9.0.7 | ||
CVE-2026-46242 | Linux kernel local privilege escalation via use-after-free race condition in epoll subsystem ("Bad Epoll") | Affected | CGF and SE versions 10.x are affected. An unprivileged local user can exploit a race condition to gain root privileges. CGF 9.x are not affected. | <= 10.0.2 | Disable shell-level access for admins | 10.0.2 | ||
CVE-2026-55199 CVE-2026-55200 CVE-2025-15661 | LibSSH2 vulnerabilities | Not affected | All currently support versions of CGF and SE are not affected as affected functionality is not used |
|
|
|
| https://www.cve.org/CVERecord?id=CVE-2026-55199 |
CVE-2026-31635 | Linux kernel privilege escalation vulnerability (DirtyDecrypt) | Not affected D | All currently support versions of CGF and SE are not affected as affected functionality is not used (not built in). |
|
|
|
| |
CVE-2026-46333 | Linux kernel vulnerability that allows unprivileged local users to read sensitive root-owned files | Affected | All currently support versions of CGF and SE are affected by this vulnerability. | <= 9.0.6 |
|
| ||
CVE-2026-46300 | Linux kernel privilege escalation vulnerability (Fragnesia) | Not affected | All currently support versions of CGF and SE are not affected as affected functionality is not used (not installed). |
|
|
|
| |
CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, CVE-2026-4893 | dnsmasq 2.92 Multiple Critical Vulnerabilities | Not affected | All currently support versions of CGF and SE are not affected as affected functionality is not used (not installed). |
|
|
|
| |
CVE-2026-35414 | OpenSSH vulnerability | Not affected | All currently support versions of CGF and SE are not affected as affected functionality is not used and can not be configured |
|
|
|
| |
CVE-2026-43500 | Linux kernel privilege escalation vulnerability (Dirty Frag) | Not affected | All currently support versions of CGF and SE are not affected as affected functionality is not used (not installed). |
|
|
|
| |
CVE-2026-43284 | Linux kernel privilege escalation vulnerability (Copyfail2: Electric Boogaloo) | Not affected | All currently support versions of CGF and SE are not affected as affected functionality is not used (not installed). |
|
|
|
| |
CVE-2026-31431 | Vulnerability in the Linux kernel's cryptographic subsystem | Affected | All currently support versions of CGF and SE are affected by this vulnerability. | <= 9.0.6 |
|
|
| |
CVE-2026-41651 | CVE-2026-41651, internally tracked as Pack2TheRoot, is a high-severity local privilege escalation vulnerability in the PackageKit daemon | Not affected | All currently support versions of CGF and SE are not affected as affected functionality is not used. |
|
|
|
| |
CVE-2026-33515 | Denial of Service in ICP Request handling
| Affected
| CGF and SE versions 9.0.5 and older, 10.0.1 and older and 10.5.0 are affected. This issue can be mitigated by configuration.
| <= 9.0.5 | BNNGF-100751
| Set “Neighbor caches discovery” to “0” (which is the default)
| 9.0.6 | https://github.com/squid-cache/squid/security/advisories/GHSA-84p4-hcx7-jj7c |