SockAnalystBarracuda ESG: pre-auth admin bypass chained to root command injection, now exploited
SockAnalyst · Security+ certified analyst.
What happened
Barracuda patched two Email Security Gateway flaws on November 2, 2026. CVE-2026-116606 (CVSS 9.3, Barracuda) is a pre-authentication authorization bypass: an attacker who can reach the ESG administrative interface can restore a crafted backup through a configuration-import function and change the appliance's global configuration without logging in. CVE-2026-111560 (CVSS 8.6) is an OS command injection in the timezone configuration field that runs as root. Chained on ESG, they give an unauthenticated attacker with Admin UI access root on the appliance. On November 9 at 9:00 PM EST Barracuda updated its advisory to say it has identified exploitation activity affecting a small number of organizations. The command-injection bug also affects Barracuda ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway. Neither CVE was on the CISA KEV catalog when we checked on November 10.
Update (2026-11-11): Now on CISA KEV. CISA added CVE-2026-116606 (ESG authentication bypass) and CVE-2026-111560 (OS command injection) to its Known Exploited Vulnerabilities catalog on November 10, 2026, with a short federal remediation deadline of November 13. Five Nines reports CISA notes the two can be chained and requires forensic triage for both entries, so check appliances for compromise, not just patch level.
Who's affected
Barracuda Email Security Gateway appliances (ESG firmware before 9.4.0.030 per the Canadian Centre for Cyber Security) whose Admin UI is reachable by the attacker; internet-exposed admin interfaces are the highest risk. CVE-2026-111560 alone (needs admin access) also affects Load Balancer ADC before 6.4.0, WAF before 11.0.1, Web Security Gateway before 16.1.100.100, Message Archiver before 5.5.4.0 and WAF Control Center before 2.2.1.
✅ Fix / patch
- Confirm ESG has patch BNSF-40425 (firmware 9.4.017 and later) or BNSF-40430 (earlier than 9.4.017) and is on the latest firmware. If automatic patching is off, apply the patch manually now and turn automatic patching back on, per Barracuda.
- Patch the other products for CVE-2026-111560: ADC and WAF BNADC-16586, Message Archiver BNMA-32468, WAF Control Center BNWF-60060, Web Security Gateway BNYF-24789.
- Restrict the administrative interface to trusted internal networks or a management VPN; Barracuda says appliances without a publicly reachable Admin UI are less exposed.
- Patching does not remove prior compromise. Review configuration-restore events, unexpected timezone or global configuration changes and new admin accounts since late October, and contact Barracuda Support if anything looks off.
🔎 Quick hunt check
No IOCs (IPs, hashes or domains) have been published by Barracuda or the national CERTs we checked. Hunt for requests to the ESG admin interface from untrusted or internet sources, especially POSTs to the admin CGI (/cgi-mod/index.cgi) that perform configuration import or restore, and for timezone or global configuration changes nobody on your team made.
MITRE ATT&CK: T1190, T1059.004, T1068, T1562.001
IOCs
No IOCs (IPs, domains or hashes) published by the sources yet.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
(index=proxy OR index=web OR index=firewall OR index=network) (dest_host="*barracuda*" OR dest_category="email_gateway" OR uri_path="/cgi-mod/*")
| search uri_path="/cgi-mod/index.cgi" (http_method=POST OR method=POST)
| eval internal=if(cidrmatch("10.0.0.0/8",src_ip) OR cidrmatch("172.16.0.0/12",src_ip) OR cidrmatch("192.168.0.0/16",src_ip),"yes","no")
| where internal="no"
| stats count min(_time) as first max(_time) as last values(uri_query) as query values(status) as status by src_ip, dest
// External POSTs to the Barracuda ESG admin CGI: the reachable Admin UI is the precondition for the CVE-2026-116606 + CVE-2026-111560 chainCommonSecurityLog
| where TimeGenerated > ago(30d)
| where RequestURL has "/cgi-mod/index.cgi" and RequestMethod =~ "POST"
| where not(ipv4_is_private(SourceIP))
| summarize Hits=count(), First=min(TimeGenerated), Last=max(TimeGenerated), URLs=make_set(RequestURL, 20) by SourceIP, DestinationIP, DeviceVendor
| order by Hits desc
// External POSTs to the Barracuda ESG admin interface; pair with appliance audit logs for config restore or timezone changes⏱ CISA deadline
Sources
- Barracuda Trust Center: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities (updated Nov 9, 2026 with exploitation)
- Canadian Centre for Cyber Security: Barracuda Networks security advisory AV26-1112, Update 1
- CCB Belgium: Authorization bypass and command injection in Barracuda ESG, Patch Immediately
- BleepingComputer: Hackers now exploit critical Barracuda ESG flaws to gain root access
- CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (Nov 10, 2026)
- Five Nines: CISA adds Chromium, Barracuda and BroadWorks flaws to KEV catalog
Related playbooks
- SignalWire FreeSWITCH CVE-2026-116779: one SIP MESSAGE can run FreeSWITCH API and OS commands, exploited in the wild · Exploited vuln · 2026-11-10
- Node-RED / Siemens IoT2050 CVE-2026-58115 (CVSS 10): unauthenticated flow deployment is being exploited for Linux bots and webshells · Exploited vuln · 2026-11-09
- Check Point Gaia CVE-2026-123039: PHP2Shell plus root zero-day exploited on Mobile Access gateways · Exploited vuln · 2026-11-13
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free