What you need to know today.

Barracuda ESG Authentication Bypass and Command Injection (CVE-2026-116606, CVE-2026-111560): Barracuda Email Security Gateway versions prior to 9.4.0.030 are vulnerable to an authentication bypass that allows an unauthenticated remote attacker to import a crafted backup archive, leading to remote code execution. Additionally, improper neutralization of shell metacharacters in the timezone configuration field allows an authenticated administrator to inject OS commands with root privileges. These flaws were actively exploited and have been patched, as reported by SecurityWeek.

SAP Critical Vulnerabilities (CVE-2026-120017, CVE-2026-76964, CVE-2026-89103, CVE-2026-89126): SAP is addressing four critical vulnerabilities, including memory corruption in SAP Web Dispatcher (CVE-2026-89126) and SAP NetWeaver Application Server ABAP (CVE-2026-76964), an authentication bypass in SAP NetWeaver AS ABAP and ABAP Platform (CVE-2026-120017), and an access control issue in SAP Gateway (CVE-2026-89103). These vulnerabilities could allow unauthenticated attackers to gain unauthorized access or execute code. The Hacker News detailed these critical patches.

Google Chrome Actively Exploited Zero-Day (CVE-2026-125350): Google Chrome versions prior to 157.0.8103.50 contain a use-after-free vulnerability in XML processing that allows a remote attacker to execute arbitrary code within the sandbox. This is the eighth actively exploited zero-day vulnerability in Chrome this year, as highlighted by The Hacker News.

Microsoft Entra Device Registration Authorization Bypass (CVE-2026-109469): An authorization bypass vulnerability in Microsoft Entra Device Registration allows an unauthorized attacker to elevate privileges over a network. This was one of many vulnerabilities addressed in Microsoft's November Patch Tuesday, as noted by Cisco Talos Intelligence.

7-Zip Brotli Decoder Vulnerability (CVE-2026-111497): A critical buffer overflow vulnerability exists in the Brotli decoder in Google Brotli versions 1.0.3 through 1.2.0. This could allow a remote, unauthenticated attacker to corrupt decoder state memory and potentially disclose sensitive information. SecurityWeek mentioned this vulnerability in the context of broader security updates.

DAEMON Tools Lite Supply Chain Attack (CVE-2026-8398): The official installation packages for DAEMON Tools Lite (versions 12.5.0.2421 through 12.5.0.2434) were compromised through a supply chain attack. These packages were distributed from the legitimate daemon-tools.cc website between April 8, 2026, and an unspecified date in May 2026, potentially exposing users to malware.