EN PT-BR
← Voltar ao feed
critical

Barracuda ESG root chain CVE-2026-116606 + CVE-2026-111560 exploited after public PoC release

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 00:34 · coletado há 1 hora

Barracuda published an advisory on November 2, 2026 for a two-flaw chain in its Email Security Gateway (ESG): CVE-2026-116606, an authorization bypass rated 9.3 (CVSS v4), and CVE-2026-111560, an OS command injection rated 8.6. Together they let an attacker reach root on the appliance. The article reports that Barracuda said on November 9 that it had seen exploitation against a small number of organizations, but the advisory version I opened (last updated November 5) contains no such statement, so that claim is unverified. Barracuda's own advisory says the bypass needs no account but does require the attacker to reach the administrative UI (trust.barracuda.com). watchTowr Labs published a write-up and a detection-artefact generator on November 5 (labs.watchtowr.com), and the article says the public code can run arbitrary commands. CISA's KEV catalog did not list either CVE in the sources checked, and the article says it still did not list them as of November 9.

Entenda a falha

A vulnerabilidade

Two chained flaws in Barracuda Email Security Gateway (ESG) give root. CVE-2026-116606 (CVSS v4 9.3) is an authorization bypass in the admin interface's password-change logic; it needs no account but does need reach to the admin UI, and it lets the attacker restore a crafted backup. CVE-2026-111560 (8.6) is an OS command injection in the timezone setting, run as root through sudo. The bypass affects only ESG versions earlier than 9.4.0.030. The injection also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway, where it still needs administrative access. Fixed build: 9.4.0.030 (one patch comparison names 9.4.0.029).

Como funciona

A request reaches the ESG admin interface and attempts a password change. When that change fails, the handler reports the error but keeps processing the rest of the request, which includes the configuration-import path. There, a compatible backup archive is accepted and restored over the global configuration. The backup's checksum uses a fixed, hard-coded secret, so a forged archive passes validation. The timezone value restored from the backup is placed into a Perl shell command, and the helper script that uses it runs through sudo, so the injected content executes as root. A single request can therefore carry both steps.

Por que é vulnerável

CVE-2026-116606 is a logic error: after a failed password change the code returns an error but does not stop, so later functions in the same request still run without authorization. CVE-2026-111560 is missing input sanitization: the timezone value goes unsanitized into a shell command that a sudo helper then runs. The hard-coded backup-checksum secret makes forging archives possible. The articles do not explain why these went unnoticed or detail what the patch changes beyond the fixed builds.

Onde está

The bypass is in the ESG password-change handler in the admin interface, with the chain reached through /cgi-mod/index.cgi and the bayesian upload handler; the injection is in the timezone handling restored from backups, in code shared across six products.

Como foi descoberta

Barracuda's disclosure timeline records reports on October 15 and October 22, 2026, and Barracuda published its advisory on November 2. Mandiant assigned both CVE records (advisories MNDT-2026-0042 and MNDT-2026-0041). watchTowr Labs then published a technical write-up and code. The article says Barracuda confirmed on November 9 that a small number of organizations were attacked, but the story could not find that wording in the advisory version it opened (last updated November 5), so treat it as unverified. Nothing public ties the activity to any actor, and CISA's KEV had not listed either CVE as of November 9.

PoC pública

watchTowr Labs published a write-up and a GitHub script it calls a Detection Artifact Generator, but which, per the article, accepts any command an operator supplies. It chains both flaws into one multipart request: a failed password change plus a forged backup. That is a working exploit for the full pre-auth chain on ESG. The article dates the release to November 3, while the story says the watchTowr post is dated November 5. With public code available and exploitation reportedly seen, patch urgently and restrict the admin interface.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 02:16.

Detalhes técnicos

CVE-2026-116606 sits in the ESG admin interface: when a password change fails, the handler sends an error response but does not stop, so the request continues into the configuration-import path and a crafted, compatible backup archive can overwrite the global configuration (labs.watchtowr.com, labs.beazley.security). The Mandiant CVE record places the bypass in versions earlier than 9.4.0.030 (hol.org).

CVE-2026-111560 is an OS command injection in the timezone field of code shared across six products. The timezone value restored from a backup's database row is placed into a Perl backtick shell command, and the helper script that consumes it runs through sudo, so injected commands execute as root (labs.watchtowr.com). Backup checksums are computed with a fixed, hard-coded secret, which lets an attacker forge a valid archive (labs.watchtowr.com). watchTowr's proof-of-concept chains these into a single multipart POST to /cgi-mod/index.cgi that submits a failed password change together with a forged backup uploaded through the bayesian upload handler (labs.watchtowr.com).

Scope differs by flaw. CVE-2026-116606 affects only ESG. CVE-2026-111560 also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway, where it still needs administrative access (trust.barracuda.com). Barracuda labels both flaws High; watchTowr's patch diff contains a comment that scores the bypass 9.8 (labs.watchtowr.com).

Mandiant assigned both CVE records and its advisories are MNDT-2026-0042 and MNDT-2026-0041 (labs.beazley.security, rescana.com). Barracuda's disclosure timeline records reports on October 15 and October 22, 2026 (windowsforum.com).

The article notes that the appliance was physically replaced by some customers after CVE-2023-2868 was exploited as a zero-day in 2023. watchTowr attributes that 2023 campaign to UNC4841 per Mandiant (labs.watchtowr.com). Nothing public ties the 2026 chain to any actor.

Remediação

Upgrade ESG to 9.4.0.030 or later, which the CVE record and the article name as the fixed build. Barracuda's advisory lists patch BNSF-40425 for ESG 9.4.017 and later and BNSF-40430 for earlier releases (trust.barracuda.com). For the other products, the advisory lists BNADC-16586 for ADC and WAF, BNMA-32468 for Message Archiver, BNWF-60060 for WCC and BNYF-24789 for WSG (trust.barracuda.com).

Restrict the admin interface to trusted internal networks, since appliances whose admin interface is not reachable from the internet are less exposed (trust.barracuda.com). Confirm that automatic patching is on, and expect that devices several versions behind may need more than one update (trust.barracuda.com).

Review any ESG with an internet-reachable admin interface for signs of compromise, including unexpected changes to the global configuration, unexpected backup restores and timezone values containing shell metacharacters. The article's own advice to check internet-facing ESG appliances for compromise applies here.

Relatos divergentes

  • The article quotes a November 9 Barracuda update that reports active exploitation. The Barracuda advisory I opened was last updated November 5 and does not contain that wording, so the exploitation claim could not be confirmed against the vendor page.
  • The article says watchTowr's proof-of-concept was public from November 3. The watchTowr post is dated November 5, 2026 (labs.watchtowr.com).
  • The article names 9.4.0.030 as the fixed build. watchTowr's patch comparison uses 9.4.0.027 against 9.4.0.029 and names 9.4.0.029 as patched (labs.watchtowr.com, cyberkendra.com). The Mandiant CVE record says versions earlier than 9.4.0.030 are affected (hol.org). This report treats 9.4.0.030 as the target build until Barracuda clarifies.
  • The article gives the bypass as 9.3 Critical. Barracuda's advisory labels it High with a CVSS score of 9.3 (trust.barracuda.com).

Linha do tempo

  1. securityonline.info ↗ · pub. 10/11/2026 00:34 · coletado 10/11 02:00 primeiro registro

    Barracuda ESG root chain CVE-2026-116606 + CVE-2026-111560 exploited after public PoC release

    ler a análise desta fonte

    Barracuda published an advisory on November 2, 2026 for a two-flaw chain in its Email Security Gateway (ESG): CVE-2026-116606, an authorization bypass rated 9.3 (CVSS v4), and CVE-2026-111560, an OS command injection rated 8.6. Together they let an attacker reach root on the appliance. The article reports that Barracuda said on November 9 that it had seen exploitation against a small number of organizations, but the advisory version I opened (last updated November 5) contains no such statement, so that claim is unverified. Barracuda's own advisory says the bypass needs no account but does require the attacker to reach the administrative UI (trust.barracuda.com). watchTowr Labs published a write-up and a detection-artefact generator on November 5 (labs.watchtowr.com), and the article says the public code can run arbitrary commands. CISA's KEV catalog did not list either CVE in the sources checked, and the article says it still did not list them as of November 9.

    Technical Details

    CVE-2026-116606 sits in the ESG admin interface: when a password change fails, the handler sends an error response but does not stop, so the request continues into the configuration-import path and a crafted, compatible backup archive can overwrite the global configuration (labs.watchtowr.com, labs.beazley.security). The Mandiant CVE record places the bypass in versions earlier than 9.4.0.030 (hol.org).

    CVE-2026-111560 is an OS command injection in the timezone field of code shared across six products. The timezone value restored from a backup's database row is placed into a Perl backtick shell command, and the helper script that consumes it runs through sudo, so injected commands execute as root (labs.watchtowr.com). Backup checksums are computed with a fixed, hard-coded secret, which lets an attacker forge a valid archive (labs.watchtowr.com). watchTowr's proof-of-concept chains these into a single multipart POST to /cgi-mod/index.cgi that submits a failed password change together with a forged backup uploaded through the bayesian upload handler (labs.watchtowr.com).

    Scope differs by flaw. CVE-2026-116606 affects only ESG. CVE-2026-111560 also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway, where it still needs administrative access (trust.barracuda.com). Barracuda labels both flaws High; watchTowr's patch diff contains a comment that scores the bypass 9.8 (labs.watchtowr.com).

    Mandiant assigned both CVE records and its advisories are MNDT-2026-0042 and MNDT-2026-0041 (labs.beazley.security, rescana.com). Barracuda's disclosure timeline records reports on October 15 and October 22, 2026 (windowsforum.com).

    The article notes that the appliance was physically replaced by some customers after CVE-2023-2868 was exploited as a zero-day in 2023. watchTowr attributes that 2023 campaign to UNC4841 per Mandiant (labs.watchtowr.com). Nothing public ties the 2026 chain to any actor.

    Remediation

    Upgrade ESG to 9.4.0.030 or later, which the CVE record and the article name as the fixed build. Barracuda's advisory lists patch BNSF-40425 for ESG 9.4.017 and later and BNSF-40430 for earlier releases (trust.barracuda.com). For the other products, the advisory lists BNADC-16586 for ADC and WAF, BNMA-32468 for Message Archiver, BNWF-60060 for WCC and BNYF-24789 for WSG (trust.barracuda.com).

    Restrict the admin interface to trusted internal networks, since appliances whose admin interface is not reachable from the internet are less exposed (trust.barracuda.com). Confirm that automatic patching is on, and expect that devices several versions behind may need more than one update (trust.barracuda.com).

    Review any ESG with an internet-reachable admin interface for signs of compromise, including unexpected changes to the global configuration, unexpected backup restores and timezone values containing shell metacharacters. The article's own advice to check internet-facing ESG appliances for compromise applies here.

    Conflicting Reports

    • The article quotes a November 9 Barracuda update that reports active exploitation. The Barracuda advisory I opened was last updated November 5 and does not contain that wording, so the exploitation claim could not be confirmed against the vendor page.
    • The article says watchTowr's proof-of-concept was public from November 3. The watchTowr post is dated November 5, 2026 (labs.watchtowr.com).
    • The article names 9.4.0.030 as the fixed build. watchTowr's patch comparison uses 9.4.0.027 against 9.4.0.029 and names 9.4.0.029 as patched (labs.watchtowr.com, cyberkendra.com). The Mandiant CVE record says versions earlier than 9.4.0.030 are affected (hol.org). This report treats 9.4.0.030 as the target build until Barracuda clarifies.
    • The article gives the bypass as 9.3 Critical. Barracuda's advisory labels it High with a CVSS score of 9.3 (trust.barracuda.com).