Barracuda ESG chain CVE-2026-116606 + CVE-2026-111560 gives unauthenticated root and is now exploited in limited attacks

Linha do tempo

1. bleepingcomputer.com ↗ · pub. 10/11/2026 07:10 · coletado 10/11 08:00

   Barracuda ESG root-access chain (CVE-2026-116606, CVE-2026-111560) now exploited in limited attacks, vendor confirms

   Barracuda's advisory update of 9 November, reported by BleepingComputer, confirms that both flaws are being exploited against a small number of organizations. This supersedes the 3 and 4 November reports that found no exploitation, so the case moves from unexploited to actively exploited by the vendor's own statement. The article gives no CISA KEV status, threat actor or indicator for this activity.

   ler a análise desta fonte ocultar

   Barracuda's advisory update of 9 November, reported by BleepingComputer, confirms that both flaws are being exploited against a small number of organizations. This supersedes the 3 and 4 November reports that found no exploitation, so the case moves from unexploited to actively exploited by the vendor's own statement. The article gives no CISA KEV status, threat actor or indicator for this activity.

   Barracuda Networks warned that attackers have begun exploiting two Email Security Gateway (ESG) flaws, CVE-2026-116606 and CVE-2026-111560, which together let them reach root on the appliance (bleepingcomputer.com). The vendor released patches about one week before the warning, and on the evening of 9 November it updated its advisory to say the flaws are being used against a small number of organizations (bleepingcomputer.com). The first flaw is an authentication weakness that lets an attacker change the global configuration, and the second lets unauthenticated attackers inject OS commands that run with root privileges (bleepingcomputer.com). Barracuda says successful attacks require access to the administrative interface, yet its advisory also labels the first flaw as pre-authentication, so the real prerequisite is still unclear (bleepingcomputer.com). The article names no threat actor, victim or indicator of compromise for the current activity. The urgency is critical because the vendor confirms exploitation and the second flaw runs as root, although exposure is limited to devices whose admin interface is reachable.

   Remediation

   • Install the patch by hand on any appliance where it was not applied automatically, and turn automatic patching back on where it was disabled (bleepingcomputer.com).
   • Keep the administrative interface off the internet and restrict it to trusted internal networks with network access controls (bleepingcomputer.com).
2. gbhackers.com ↗ · pub. 10/11/2026 03:31 · coletado 10/11 04:00

   Barracuda ESG pre-auth authorization bypass and command injection chain gives unauthenticated root

   The article names 9.4.0.029 as the release that carries both fixes, and says watchTowr's comparison of 9.4.0.027 with 9.4.0.029 shows them. The vendor-linked record instead places the first fixed release at 9.4.0.030 and lists 9.4.0.029 as affected (ionix.io), so the remediation guidance in the case is corrected and the 9.4.0.029 claim is kept under Conflicting Reports.

   ler a análise desta fonte ocultar

   The article names 9.4.0.029 as the release that carries both fixes, and says watchTowr's comparison of 9.4.0.027 with 9.4.0.029 shows them. The vendor-linked record instead places the first fixed release at 9.4.0.030 and lists 9.4.0.029 as affected (ionix.io), so the remediation guidance in the case is corrected and the 9.4.0.029 claim is kept under Conflicting Reports.

   Barracuda Networks patched two chainable flaws in its Email Security Gateway (ESG) appliances: CVE-2026-116606 (CVSS 9.3), a pre-authentication authorization bypass, and CVE-2026-111560 (CVSS 8.6), an OS command injection that also reaches other Barracuda products. Per gbhackers.com, watchTowr Labs researcher Sina Kheirkhah published the analysis on November 5, 2026, after comparing ESG 9.4.0.027 with 9.4.0.029. Chained together, the flaws let an unauthenticated attacker run commands as root on the appliance, which the article presents as full control of the gateway. The article names 9.4.0.029 as the fixed release, but the vendor-linked record places the boundary at 9.4.0.030 (ionix.io), so 9.4.0.029 should be treated as still exposed. Neither the article nor the pages checked reports exploitation in the wild or a CISA KEV listing; that absence is the main limit, but a pre-authentication path to root on an internet-facing gateway, with a public detection tool, justifies the critical rating.

   Technical Details

   • The bypass sits in the password-change path of Index.pm: a request with mismatched passwords yields a login-screen role rather than ending the request, so later response handlers still run.
   • The injection sits in Backup2.pm and fix_tz.pl, where the system_timezone value goes unvalidated into a Perl backtick sed call. fix_tz.pl runs through sudo, so injected commands execute as root.
   • The entry point is the bayesian_upload.pm handler, which accepts a crafted backup whose Spam_Config component writes the malicious system_timezone value into the local MySQL database.

   Remediation

   • Upgrade Barracuda ESG to 9.4.0.030 or later and keep firmware patches enabled (ionix.io), treating 9.4.0.029 as affected.
   • Keep administrative interfaces off the internet and restrict them to trusted internal networks (gbhackers.com).
   • Review backup restoration activity, investigate unexpected configuration changes and monitor for suspicious command execution on the appliance (gbhackers.com).
   • Run the Detection Artefact Generator from watchTowr's GitHub repository to test exposure (github.com/watchtowrlabs).
3. securityonline.info ↗ · pub. 10/11/2026 00:34 · coletado 10/11 02:00

   Barracuda ESG root chain CVE-2026-116606 + CVE-2026-111560 exploited after public PoC release

   ler a análise desta fonte ocultar

   Barracuda published an advisory on November 2, 2026 for a two-flaw chain in its Email Security Gateway (ESG): CVE-2026-116606, an authorization bypass rated 9.3 (CVSS v4), and CVE-2026-111560, an OS command injection rated 8.6. Together they let an attacker reach root on the appliance. The article reports that Barracuda said on November 9 that it had seen exploitation against a small number of organizations, but the advisory version I opened (last updated November 5) contains no such statement, so that claim is unverified. Barracuda's own advisory says the bypass needs no account but does require the attacker to reach the administrative UI (trust.barracuda.com). watchTowr Labs published a write-up and a detection-artefact generator on November 5 (labs.watchtowr.com), and the article says the public code can run arbitrary commands. CISA's KEV catalog did not list either CVE in the sources checked, and the article says it still did not list them as of November 9.

   Technical Details

   CVE-2026-116606 sits in the ESG admin interface: when a password change fails, the handler sends an error response but does not stop, so the request continues into the configuration-import path and a crafted, compatible backup archive can overwrite the global configuration (labs.watchtowr.com, labs.beazley.security). The Mandiant CVE record places the bypass in versions earlier than 9.4.0.030 (hol.org).

   CVE-2026-111560 is an OS command injection in the timezone field of code shared across six products. The timezone value restored from a backup's database row is placed into a Perl backtick shell command, and the helper script that consumes it runs through sudo, so injected commands execute as root (labs.watchtowr.com). Backup checksums are computed with a fixed, hard-coded secret, which lets an attacker forge a valid archive (labs.watchtowr.com). watchTowr's proof-of-concept chains these into a single multipart POST to /cgi-mod/index.cgi that submits a failed password change together with a forged backup uploaded through the bayesian upload handler (labs.watchtowr.com).

   Scope differs by flaw. CVE-2026-116606 affects only ESG. CVE-2026-111560 also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway, where it still needs administrative access (trust.barracuda.com). Barracuda labels both flaws High; watchTowr's patch diff contains a comment that scores the bypass 9.8 (labs.watchtowr.com).

   Mandiant assigned both CVE records and its advisories are MNDT-2026-0042 and MNDT-2026-0041 (labs.beazley.security, rescana.com). Barracuda's disclosure timeline records reports on October 15 and October 22, 2026 (windowsforum.com).

   The article notes that the appliance was physically replaced by some customers after CVE-2023-2868 was exploited as a zero-day in 2023. watchTowr attributes that 2023 campaign to UNC4841 per Mandiant (labs.watchtowr.com). Nothing public ties the 2026 chain to any actor.

   Remediation

   Upgrade ESG to 9.4.0.030 or later, which the CVE record and the article name as the fixed build. Barracuda's advisory lists patch BNSF-40425 for ESG 9.4.017 and later and BNSF-40430 for earlier releases (trust.barracuda.com). For the other products, the advisory lists BNADC-16586 for ADC and WAF, BNMA-32468 for Message Archiver, BNWF-60060 for WCC and BNYF-24789 for WSG (trust.barracuda.com).

   Restrict the admin interface to trusted internal networks, since appliances whose admin interface is not reachable from the internet are less exposed (trust.barracuda.com). Confirm that automatic patching is on, and expect that devices several versions behind may need more than one update (trust.barracuda.com).

   Review any ESG with an internet-reachable admin interface for signs of compromise, including unexpected changes to the global configuration, unexpected backup restores and timezone values containing shell metacharacters. The article's own advice to check internet-facing ESG appliances for compromise applies here.

   Conflicting Reports

   • The article quotes a November 9 Barracuda update that reports active exploitation. The Barracuda advisory I opened was last updated November 5 and does not contain that wording, so the exploitation claim could not be confirmed against the vendor page.
   • The article says watchTowr's proof-of-concept was public from November 3. The watchTowr post is dated November 5, 2026 (labs.watchtowr.com).
   • The article names 9.4.0.030 as the fixed build. watchTowr's patch comparison uses 9.4.0.027 against 9.4.0.029 and names 9.4.0.029 as patched (labs.watchtowr.com, cyberkendra.com). The Mandiant CVE record says versions earlier than 9.4.0.030 are affected (hol.org). This report treats 9.4.0.030 as the target build until Barracuda clarifies.
   • The article gives the bypass as 9.3 Critical. Barracuda's advisory labels it High with a CVSS score of 9.3 (trust.barracuda.com).
4. labs.watchtowr.com ↗ · pub. 05/11/2026 18:19 · coletado 05/11 19:00

   watchTowr details pre-auth root RCE chain in Barracuda ESG (CVE-2026-116606 + CVE-2026-111560)

   watchTowr's technical write-up shows the two flaws chain into unauthenticated, remote root RCE through one POST request, so the administrator prerequisite does not hold for the chain. It gives root causes (missing bailout on failed password change, timezone value injected into a sed shell command run as root via sudo, static backup checksum secret) and releases a Detection Artefact Generator, which raises the risk of exploitation.

   ler a análise desta fonte ocultar

   watchTowr's technical write-up shows the two flaws chain into unauthenticated, remote root RCE through one POST request, so the administrator prerequisite does not hold for the chain. It gives root causes (missing bailout on failed password change, timezone value injected into a sed shell command run as root via sudo, static backup checksum secret) and releases a Detection Artefact Generator, which raises the risk of exploitation.

   watchTowr Labs published a root-cause analysis of CVE-2026-116606 and CVE-2026-111560 in the Barracuda Email Security Gateway (ESG). Chained, they give an unauthenticated remote attacker root command execution with a single crafted POST to /cgi-mod/index.cgi. The researchers diffed ESG 9.4.0.027 (vulnerable) against 9.4.0.029 and released a Detection Artefact Generator on GitHub. Public technical detail makes reproduction easy, but the article does not report in-the-wild exploitation. The chain removes the administrator prerequisite that Barracuda's advisory had attached to the command injection.

   Technical Details

   • Authorization bypass (CVE-2026-116606): in Index.pm, a failed password change (ERROR_PASSWD_CHANGE) returned $userrole instead of calling bailout(). Execution continued into response(), so module handlers still ran for an unauthenticated request. Sending new_password and retype_password with mismatched values triggers it.
   • Command injection (CVE-2026-111560): the system_timezone value is interpolated into Perl backticks running sed -i in Backup2::finalize_restore (Backup2.pm) and in fix_tz.pl. A value such as UTC#';<cmd>;# breaks out of the sed command. fix_tz.pl is run through sudo, so the injected command runs as root.
   • Chain: the multipart POST carries pu_bayesian_upload=1 and a malicious backup tar in the bayesian field, handled by bayesian_upload.pm, which calls restore_all. The backup's backup.xml lists a Spam_Config component, a MySQL dump that sets the system_timezone row to the payload.
   • Integrity check is forgeable: component checksums are md5(file_bytes + secret + "."). The secret is the static string "Barracuda Networks is your new best friend", so an attacker can compute valid checksums.
   • Scoring: the patch comment says CVSS 9.8, while Barracuda's advisory says 9.3. watchTowr guesses the 9.8 reflects both flaws scored together.
   • Barracuda shipped several patch files. watchTowr reviewed two: Patch-1 for the authorization bypass and Patch-2 for the command injection. The fix validates system_timezone against /usr/share/zoneinfo/ and replaces the shell sed with native Perl file rewriting.

   Remediation

   • Install the Barracuda patches and use ESG firmware 9.4.0.029 or later (watchTowr compared 027 against 029). Mandiant's advisory, as reported in the existing case, puts the fixed boundary at 9.4.0.030. Check Barracuda's advisory for the exact build.
   • Restrict management and web interfaces from the internet. Use watchTowr's Detection Artefact Generator to test exposure.
5. securityweek.com ↗ · pub. 04/11/2026 11:24 · coletado 04/11 12:00

   Barracuda patches ESG authentication bypass (CVE-2026-116606) chainable with root command injection (CVE-2026-111560)

   SecurityWeek adds Mandiant's advisories as the source of the technical detail: the bypass affects ESG versions earlier than 9.4.0.030 and is exploitable without authentication. According to Mandiant, Barracuda reported the command injection on Oct 15 and the authentication bypass on Oct 22. It also notes that Barracuda's own advisory is inconsistent, marking admin access as required while calling the bypass pre-authentication, and that neither advisory mentions exploitation in the wild.

   ler a análise desta fonte ocultar

   SecurityWeek adds Mandiant's advisories as the source of the technical detail: the bypass affects ESG versions earlier than 9.4.0.030 and is exploitable without authentication. According to Mandiant, Barracuda reported the command injection on Oct 15 and the authentication bypass on Oct 22. It also notes that Barracuda's own advisory is inconsistent, marking admin access as required while calling the bypass pre-authentication, and that neither advisory mentions exploitation in the wild.

   Barracuda released patches for two chainable flaws that can give an attacker root access to its Email Security Gateway (ESG) appliances. CVE-2026-116606 (CVSS 9.3) is an authentication bypass that affects only ESG. CVE-2026-111560 (CVSS 8.6) is a command injection that also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Neither advisory says whether the flaws have been exploited in the wild. Barracuda says an attacker must be able to reach the appliance's admin interface.

   Technical Details

   • CVE-2026-116606: in ESG versions earlier than 9.4.0.030, an unauthenticated remote attacker can invoke a configuration-import function and restore a crafted, compatible backup archive. This changes the appliance's global configuration (Mandiant advisory, as quoted by securityweek.com).
   • CVE-2026-111560: the injection sits in the timezone configuration setting, in code shared across several Barracuda products. An attacker with administrator privileges can run OS commands as root.
   • Chained, the two flaws bypass authorization controls and give root access (Barracuda).
   • Barracuda's advisory marks administrative access as required for both bugs, yet also calls CVE-2026-116606 pre-authentication. Mandiant says the ESG bug needs no authentication.
   • According to Mandiant, Barracuda reported the command injection on October 15 and the authentication bypass on October 22.
   • Background: ESG was previously hit by Chinese cyberspies through the zero-day CVE-2023-2868, starting in October 2022. Barracuda then told customers to replace compromised devices.

   Remediation

   • Update to the newest firmware and confirm that every available patch is installed. Install manually any patch that was not applied automatically, and re-enable automatic patching where it is disabled.
   • Keep admin interfaces reachable only from trusted internal networks.
6. bleepingcomputer.com ↗ · pub. 03/11/2026 12:06 · coletado 03/11 14:00 primeiro registro

   Barracuda patches ESG auth bypass (CVE-2026-116606) and root command injection (CVE-2026-111560) across several appliances

   ler a análise desta fonte ocultar

   Barracuda Networks disclosed and patched two chainable flaws. CVE-2026-116606 (CVSS 9.3 per secondary reporting) is an authorization bypass in the Email Security Gateway (ESG). It lets an attacker change the appliance's global configuration. CVE-2026-111560 (CVSS 8.6 per secondary reporting) is an OS command injection that runs as root. It needs admin privileges. Per secondary reporting, it affects ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. The article only says that a table lists the affected devices and patches. Barracuda says exploitation requires access to the administrative interface. Chained, the two flaws give root access. Secondary sources checked on 3 November report no exploitation in the wild and no CISA KEV listing. Barracuda ESG has been a past target of UNC4841.

   Technical Details

   • CVE-2026-116606 is ESG-only. Per secondary sources, it lets an unauthenticated attacker restore a crafted configuration backup, and it affects versions before 9.4.0.030 (threatdefence.com, securityaffairs.com).
   • CVE-2026-111560 is injection in the timezone configuration field, running as root (secondary sources).
   • A Barracuda update dated 6 November reportedly says attackers do not need admin privileges, which conflicts with the article's prerequisite.

   Remediation

   • Apply the Barracuda security patches and run the latest firmware. The article refers to a table of affected devices and patches but does not reproduce it, and it gives no patch IDs. The IDs below come from secondary reporting, not from the article, and should be checked against Barracuda's advisory. ESG: BNSF-40425 (9.4.017 and later) or BNSF-40430 (below 9.4.017). Load Balancer ADC and WAF: BNADC-16586. Message Archiver: BNMA-32468. WAF Control Center: BNWF-60060. Web Security Gateway: BNYF-24789.
   • Keep the administrative interfaces off the internet and restrict them to trusted internal networks (bleepingcomputer.com).

   Conflicting Reports

   The article says exploitation requires access to the admin interface. A Barracuda update dated 6 November reportedly says attackers do not need admin privileges. The vendor's later statement is the more authoritative.

Repetiram sem novidade

• thehackernews.com — Barracuda Email Security Gateway auth bypass and command injection chain (CVE-2026-116606, CVE-2026-111560) gives unauthenticated root
• securityaffairs.com — Barracuda patches chainable ESG auth bypass and root command injection flaws across six appliance products
• gbhackers.com — Barracuda patches ESG authorization bypass (CVE-2026-116606) and root command injection (CVE-2026-111560)
• thehackernews.com — Barracuda discloses chainable ESG authorization bypass and command injection flaws enabling root access