ARTICLE ORIGINAL MAG212 CYBER

Barracuda ESG Exploited: Pre-Auth Bypass Plus Command Injection Chains to Root

novembre 14, 2026 · El Mostafa Ouchen

Internet to root in two flaws: Two-step chain on a Barracuda Email Security Gateway: a pre-authentication bypass of the admin interface, then command injection through the timezone field to root, with "keep admin UI off the internet" and patch shield

From the MAG212 CYBER Weekly, 14 November 2026. Status labels: confirmed by vendor, reported by researchers, or unverified. Every command below is copied from official documentation and was not tested by MAG212; run it only on systems you are authorised to administer.

Status: Confirmed by vendor. Barracuda’s 9 November update says, “We have identified exploitation activity affecting a small number of organizations.” Both CVEs are in KEV (added 10 Nov), and the due date of 13 Nov has passed [1][11].

Ce qui s'est passé

Barracuda’s advisory was published on 2 November and updated on 5 and 9 November. It covers two flaws disclosed through Mandiant that together can “bypass authorization controls and obtain root access to the device” [11][12][13]. No IOCs or attribution are published.

Qui est concerné ?

  • CVE-2026-116606: pre-authentication authorization bypass, CWE-288, CVSS 4.0 9.3. ESG only, versions before 9.4.0.030 [13].
  • CVE-2026-111560: authenticated admin OS command injection through the timezone field, giving root; CVSS 4.0 8.6 (PR:H) [12]. Affects:
    • ESG ≤ 9.4.0.27
    • ADC ≤ 6.4.0
    • WAF ≤ 11.0.1
    • WSG ≤ 16.1.100.100
    • BMA ≤ 5.5.4.0
    • WCC ≤ 2.2.1
ProduitPatch (per Barracuda [11])
Passerelle de sécurité de messagerie (ESG)BNSF-40425 (9.4.017 and later) / BNSF-40430 (before 9.4.017)
Équilibreur de charge ADCBNADC-16586
Message Archiver (BMA)BNMA-32468
Web Communication / WCCBNWF-60060
WAFBNADC-16586
Passerelle de sécurité Web (WSG)BNYF-24789

Why this matters

Email security gateways hold directory credentials and see every inbound message, which makes them tier-0 assets. Barracuda has confirmed exploitation but published no indicators, so defenders must rely on exposure history and configuration review rather than signatures. The KEV deadline for both CVEs has already passed. (MAG212 analysis)

Two-step chain on a Barracuda Email Security Gateway: a pre-authentication bypass of the admin interface, then command injection through the timezone field to root, with "keep admin UI off the internet" and patch shields.
Diagram: MAG212 CYBER. Solid red = observed or vendor-confirmed; dashed amber = reported or unverified; green = recommended control.

Comment fonctionne l'attaque

  1. An unauthenticated request reaches the ESG administrative interface and bypasses authorization (CVE-2026-116606).
  2. With admin-level access, the attacker injects OS commands into the timezone field (CVE-2026-111560), which run as root.
  3. Unknown: the post-exploitation activity, and whether every in-the-wild case used both steps.

On non-ESG products only step 2 applies, and it requires administrator access.

Ce que les défenseurs doivent surveiller

Barracuda has published no IOCs [11]. MAG212 suggestions, labelled as inference:

  • admin-interface sessions from unfamiliar IP addresses
  • unexpected timezone or system-configuration changes in the appliance audit log
  • outbound connections from the appliance to hosts it does not normally contact

How to investigate

Establish whether the admin UI was reachable from the internet at any point since 2 November. Export the appliance’s admin audit and system logs. Engage Barracuda support if you were exposed and unpatched.

Contenir et remédier (dans l'ordre)

  1. Remove admin interfaces from internet exposure. This is Barracuda’s explicit guidance [11].
  2. Confirm the patch for each product (table above).
  3. If you were exposed and unpatched during the window, treat the device as potentially compromised: rotate admin credentials and any mail-flow or LDAP integration secrets stored on it, and work with the vendor on a rebuild.

Vérifier la récupération

Confirm the patch identifier appears on each appliance. Confirm the admin UI is unreachable from an external vantage point.

Prévention et sensibilisation

Email gateways hold directory credentials and see all inbound mail, so treat them as tier-0 assets.

No command panels. No official command documentation was located.

Sujets connexes sur MAG212 CYBER

Sources

  1. [1] CISA (GitHub mirror), “Known Exploited Vulnerabilities catalog JSON, catalogVersion 2026.11.13”, 13 Nov 2026, 20:24 UTC. link
  2. [11] Barracuda Trust Center, “Pre-authentication authorization bypass and command injection”, 2 Nov; updated 5 and 9 Nov 2026. link
  3. [12] Mandiant, “MNDT-2026-0041 (CVE-2026-111560)”, Nov 2026. link
  4. [13] Mandiant, “MNDT-2026-0042 (CVE-2026-116606)”, Nov 2026. link

Written and edited by El Mostafa Ouchen for MAG212 CYBER. Facts checked against the sources above as of 14 November 2026, 10:05 AM PST. Diagrams are original MAG212 CYBER illustrations.