{"id":3959,"date":"2026-11-05T07:11:18","date_gmt":"2026-11-05T15:11:18","guid":{"rendered":"https:\/\/cyber.mag212.com\/barracuda-esg-cve-2026-116606-cve-2026-111560-root-chain\/"},"modified":"2026-11-05T07:11:18","modified_gmt":"2026-11-05T15:11:18","slug":"barracuda-esg-cve-2026-116606-cve-2026-111560-root-chain","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/barracuda-esg-cve-2026-116606-cve-2026-111560-root-chain\/","title":{"rendered":"Barracuda CVE-2026-116606 et CVE-2026-111560\u00a0: De l\u2019interface d\u2019administration \u00e0 l\u2019acc\u00e8s root, et le correctif pour chaque produit"},"content":{"rendered":"

Barracuda has patched two flaws that, chained together, let an attacker who can reach an appliance’s admin interface run commands as root. CVE-2026-116606<\/strong> affects the Email Security Gateway (ESG). CVE-2026-111560<\/strong> affects six Barracuda products. No exploitation has been reported, but the first fix doesn’t need a patch: take admin interfaces off untrusted networks.<\/p>\n\n

Faits cl\u00e9s<\/h2>\n\n
Article<\/th>D\u00e9tail<\/th><\/tr><\/thead>
Advisory<\/td>Barracuda, “Pre-Authentication Authorization Bypass and Command Injection”, November 2, 2026<\/td><\/tr>
CVE-2026-116606<\/td>CVSS 4.0 9.3 (CWE-288); ESG before 9.4.0.030; config import accepts a crafted backup (Mandiant MNDT-2026-0042)<\/td><\/tr>
CVE-2026-111560<\/td>CVSS 4.0 8.6 (CWE-78); OS command injection via the timezone setting, runs as root (Mandiant MNDT-2026-0041)<\/td><\/tr>
Chained impact<\/td>Authorization bypass to root access, per Barracuda<\/td><\/tr>
Exploitation<\/td>None reported in sources we checked; no KEV listing found<\/td><\/tr>
Alerts<\/td>ThaiCERT (Nov 5); Canadian Cyber Centre AV26-1112<\/td><\/tr><\/tbody><\/table><\/figure>\n\n
\"Diagram
The chain as Barracuda and Mandiant describe it, and the patch for each product. MAG212 CYBER original diagram.<\/figcaption><\/figure>\n\n

How the chain works<\/h2>\n\n

Mandiant’s advisory for CVE-2026-116606 says an unauthenticated attacker can reach ESG’s configuration-import function and restore a crafted backup archive. Its advisory for CVE-2026-111560 says an administrator-level attacker can inject operating-system commands through the timezone configuration field, and those commands run as root. Barracuda says that, chained, the flaws let an attacker “bypass authorization controls and obtain root access to the device.”<\/p>\n\n

One conflict to know about:<\/strong> Barracuda’s own table says “Administrative access required” for both CVEs and labels both “High”. Mandiant rates the bypass as needing no privileges, and the CVE record rates 9.3 as Critical. In both readings, the attacker has to be able to reach the admin interface.<\/p>\n\n

Affected products and patches<\/h2>\n\n
Produit<\/th>CVE-2026-111560 vulnerable up to<\/th>Correctif<\/th><\/tr><\/thead>
Email Security Gateway<\/td>9.4.0.27 (and CVE-2026-116606 before 9.4.0.030)<\/td>BNSF-40425 (firmware 9.4.017 and later) or BNSF-40430 (older)<\/td><\/tr>
Load Balancer ADC<\/td>6.4.0<\/td>BNADC-16586<\/td><\/tr>
Web Application Firewall<\/td>11.0.1<\/td>BNADC-16586<\/td><\/tr>
Web Security Gateway<\/td>16.1.100.100<\/td>BNYF-24789<\/td><\/tr>
Message Archiver<\/td>5.5.4.0<\/td>BNMA-32468<\/td><\/tr>
WAF Control Center<\/td>2.2.1<\/td>BNWF-60060<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Versions are from the CVE record and Mandiant; the Canadian Cyber Centre lists the same numbers as “prior to”. Version formats differ between sources, so confirm your build with Barracuda Support.<\/p>\n\n

What to do, in order<\/h2>\n\n
  1. Restrict admin interfaces<\/strong> to trusted internal management networks. This is Barracuda’s first recommendation.<\/li>
  2. Confirm the firmware is current<\/strong>, then apply the patch for each product. If automatic patching didn’t apply it, install it manually and turn auto-patching on.<\/li>
  3. Devices several versions behind<\/strong> may need more than one update; Barracuda says to contact support.<\/li>
  4. If root access is suspected,<\/strong> preserve evidence with vendor support before rebuilding, then rotate secrets the appliance held.<\/li>
  5. V\u00e9rifier<\/strong> patch status on every node, standby units included. Confirm the admin UI is refused from untrusted zones and that mail flow, load balancing or archiving works normally.<\/li><\/ol>\n\n

    What to look for<\/h2>\n\n