{"id":4289,"date":"2026-11-14T10:58:32","date_gmt":"2026-11-14T18:58:32","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=4289"},"modified":"2026-11-14T10:59:45","modified_gmt":"2026-11-14T18:59:45","slug":"barracuda-esg-exploited-two-flaw-root-chain-analysis","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/barracuda-esg-exploited-two-flaw-root-chain-analysis\/","title":{"rendered":"Barracuda ESG Exploited: Pre-Auth Bypass Plus Command Injection Chains to Root"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><em>From the <a href=\"https:\/\/cyber.mag212.com\/the-keys-were-already-inside-mag212-cyber-weekly-november-14-2026\/\">MAG212 CYBER Weekly, 14 November 2026<\/a>. Status labels: confirmed by vendor, reported by researchers, or unverified. Every command below is copied from official documentation and was <strong>not tested by MAG212<\/strong>; run it only on systems you are authorised to administer.<\/em><\/p>\n\n\n\n<p class=\"m2-status wp-block-paragraph\"><strong>Status:<\/strong> <strong>Confirmed by vendor.<\/strong> Barracuda&#8217;s 9 November update says, &#8220;We have identified exploitation activity affecting a small number of organizations.&#8221; Both CVEs are in KEV (added 10 Nov), and the due date of <strong>13 Nov has passed<\/strong> <sup><a href=\"#src-1\">[1]<\/a><\/sup><sup><a href=\"#src-11\">[11]<\/a><\/sup>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Barracuda&#8217;s advisory was published on 2 November and updated on 5 and 9 November. It covers two flaws disclosed through Mandiant that together can &#8220;bypass authorization controls and obtain root access to the device&#8221; <sup><a href=\"#src-11\">[11]<\/a><\/sup><sup><a href=\"#src-12\">[12]<\/a><\/sup><sup><a href=\"#src-13\">[13]<\/a><\/sup>. No IOCs or attribution are published.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Who is affected<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE-2026-116606:<\/strong> pre-authentication authorization bypass, CWE-288, CVSS 4.0 9.3. ESG only, versions before 9.4.0.030 <sup><a href=\"#src-13\">[13]<\/a><\/sup>.<\/li>\n\n<li><strong>CVE-2026-111560:<\/strong> authenticated admin OS command injection through the timezone field, giving root; CVSS 4.0 8.6 (PR:H) <sup><a href=\"#src-12\">[12]<\/a><\/sup>. Affects:<ul><li>ESG \u2264 9.4.0.27<\/li><li>ADC \u2264 6.4.0<\/li><li>WAF \u2264 11.0.1<\/li><li>WSG \u2264 16.1.100.100<\/li><li>BMA \u2264 5.5.4.0<\/li><li>WCC \u2264 2.2.1<\/li><\/ul><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Product<\/th><th>Patch (per Barracuda <sup><a href=\"#src-11\">[11]<\/a><\/sup>)<\/th><\/tr><\/thead><tbody><tr><td>Email Security Gateway (ESG)<\/td><td>BNSF-40425 (9.4.017 and later) \/ BNSF-40430 (before 9.4.017)<\/td><\/tr><tr><td>Load Balancer ADC<\/td><td>BNADC-16586<\/td><\/tr><tr><td>Message Archiver (BMA)<\/td><td>BNMA-32468<\/td><\/tr><tr><td>Web Communication \/ WCC<\/td><td>BNWF-60060<\/td><\/tr><tr><td>WAF<\/td><td>BNADC-16586<\/td><\/tr><tr><td>Web Security Gateway (WSG)<\/td><td>BNYF-24789<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Why this matters<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Email security gateways hold directory credentials and see every inbound message, which makes them tier-0 assets. Barracuda has confirmed exploitation but published no indicators, so defenders must rely on exposure history and configuration review rather than signatures. The KEV deadline for both CVEs has already passed. <em>(MAG212 analysis)<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/barracuda-esg-cve-2026-116606-cve-2026-111560-root-chain-diagram.png\"><img decoding=\"async\" src=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/barracuda-esg-cve-2026-116606-cve-2026-111560-root-chain-diagram.png\" alt=\"Two-step chain on a Barracuda Email Security Gateway: a pre-authentication bypass of the admin interface, then command injection through the timezone field to root, with &quot;keep admin UI off the internet&quot; and patch shields.\"\/><\/a><figcaption class=\"wp-element-caption\">Diagram: MAG212 CYBER. Solid red = observed or vendor-confirmed; dashed amber = reported or unverified; green = recommended control.<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">How the attack works<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>An unauthenticated request reaches the ESG administrative interface and bypasses authorization (CVE-2026-116606).<\/li>\n\n<li>With admin-level access, the attacker injects OS commands into the timezone field (CVE-2026-111560), which run as root.<\/li>\n\n<li><em>Unknown:<\/em> the post-exploitation activity, and whether every in-the-wild case used both steps.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">On non-ESG products only step 2 applies, and it requires administrator access.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What defenders should look for<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Barracuda has published <strong>no IOCs<\/strong> <sup><a href=\"#src-11\">[11]<\/a><\/sup>. MAG212 suggestions, labelled as inference:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>admin-interface sessions from unfamiliar IP addresses<\/li>\n\n<li>unexpected timezone or system-configuration changes in the appliance audit log<\/li>\n\n<li>outbound connections from the appliance to hosts it does not normally contact<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How to investigate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Establish whether the admin UI was reachable from the internet at any point since 2 November. Export the appliance&#8217;s admin audit and system logs. Engage Barracuda support if you were exposed and unpatched.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Contain and remediate (in order)<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Remove admin interfaces from internet exposure. This is Barracuda&#8217;s explicit guidance <sup><a href=\"#src-11\">[11]<\/a><\/sup>.<\/li>\n\n<li>Confirm the patch for each product (table above).<\/li>\n\n<li>If you were exposed and unpatched during the window, treat the device as potentially compromised: rotate admin credentials and any mail-flow or LDAP integration secrets stored on it, and work with the vendor on a rebuild.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Verify recovery<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm the patch identifier appears on each appliance. Confirm the admin UI is unreachable from an external vantage point.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prevention and awareness<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Email gateways hold directory credentials and see all inbound mail, so treat them as tier-0 assets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>No command panels.<\/em> No official command documentation was located.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Related on MAG212 CYBER<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyber.mag212.com\/the-keys-were-already-inside-mag212-cyber-weekly-november-14-2026\/\">MAG212 CYBER Weekly, 14 November 2026: The keys were already inside<\/a> (full issue and PDF)<\/li>\n\n<li><a href=\"https:\/\/cyber.mag212.com\/subscribe-free\/\">Subscribe free to MAG212 CYBER<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><span id=\"src-1\">[1]<\/span> CISA (GitHub mirror), &#8220;Known Exploited Vulnerabilities catalog JSON, catalogVersion 2026.11.13&#8221;, 13 Nov 2026, 20:24 UTC. <a href=\"https:\/\/raw.githubusercontent.com\/cisagov\/kev-data\/main\/known_exploited_vulnerabilities.json\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-11\">[11]<\/span> Barracuda Trust Center, &#8220;Pre-authentication authorization bypass and command injection&#8221;, 2 Nov; updated 5 and 9 Nov 2026. <a href=\"https:\/\/trust.barracuda.com\/security\/pre-authentication-authorization-bypass-command-injection\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-12\">[12]<\/span> Mandiant, &#8220;MNDT-2026-0041 (CVE-2026-111560)&#8221;, Nov 2026. <a href=\"https:\/\/github.com\/mandiant\/Vulnerability-Disclosures\/blob\/master\/2026\/MNDT-2026-0041.md\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-13\">[13]<\/span> Mandiant, &#8220;MNDT-2026-0042 (CVE-2026-116606)&#8221;, Nov 2026. <a href=\"https:\/\/github.com\/mandiant\/Vulnerability-Disclosures\/blob\/master\/2026\/MNDT-2026-0042.md\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Written and edited by El Mostafa Ouchen for MAG212 CYBER. Facts checked against the sources above as of 14 November 2026, 10:05 AM PST. Diagrams are original MAG212 CYBER illustrations.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Barracuda confirms a small number of customers were hit by a two-flaw chain on its Email Security Gateway. Which products need which patch, and how to investigate.<\/p>","protected":false},"author":1,"featured_media":4248,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,13,14],"tags":[197,199,198,299,376],"class_list":["post-4289","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-cyber-incidents","category-vulnerabilities","tag-barracuda","tag-cve-2026-111560","tag-cve-2026-116606","tag-email-security","tag-esg"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4289"}],"version-history":[{"count":1,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4289\/revisions"}],"predecessor-version":[{"id":4290,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4289\/revisions\/4290"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4248"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4289"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}