{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-6755147B",
  "slug": "cve-2026-116606-barracuda-email-security-gateway-auth-bypass-root",
  "title": "Barracuda Email Security Gateway chained from no login to root through the admin interface (CVE-2026-116606, CVE-2026-111560)",
  "aliases": [
    "CVE-2026-116606",
    "CVE-2026-111560",
    "MNDT-2026-0042",
    "MNDT-2026-0041",
    "Barracuda ESG authentication bypass config restore",
    "Barracuda timezone command injection"
  ],
  "summary": "Barracuda and Mandiant disclosed two bugs on 2026-11-02. CVE-2026-116606 (CVSS 4.0 9.3, CWE-288) is an authentication bypass in Barracuda Email Security Gateway (ESG) that lets an unauthenticated remote attacker invoke the configuration-import function and restore a crafted, compatible backup, modifying the appliance's global configuration. CVE-2026-111560 (CVSS 4.0 8.6, CWE-78) is an OS command injection in the timezone configuration field that runs as root and needs administrator privileges; it affects ESG, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center. Barracuda says that exploited in combination they can bypass authorization controls and give root on the device, and that exploitation requires access to the administrative interface. Barracuda's Campus page names ESG firmware 9.4.0.029 as the fix; the CVE record and Mandiant list the bypass as affecting versions earlier than 9.4.0.030. Patch IDs: ESG BNSF-40425 (9.4.017+) and BNSF-40430 (older), ADC and WAF BNADC-16586, BMA BNMA-32468, WCC BNWF-60060, WSG BNYF-24789. No exploitation reported and not on CISA KEV as of catalog 2026.10.30.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "Barracuda's Campus article says ESG 9.4.0.029 includes the patches, while the CVE record and Mandiant MNDT-2026-0042 say the bypass affects versions earlier than 9.4.0.030; HOL has not confirmed which build closes CVE-2026-116606. Barracuda's advisory summary lists 'Authentication Required: Yes, administrative access' for both CVEs while also calling CVE-2026-116606 pre-authentication and the CVE record scores it PR:N; HOL reads this as network access to the admin interface. Barracuda and Mandiant publish no technical details of the bypass path.",
  "firstObservedAt": "2026-10-15T00:00:00.000Z",
  "lastObservedAt": "2026-11-02T14:28:29.561Z",
  "publishedAt": "2026-11-02T14:35:13.174Z",
  "reviewedAt": "2026-11-02T14:34:45.470Z",
  "expiresAt": "2026-11-02T14:28:29.561Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "barracuda-advisory",
      "label": "Barracuda Trust Center: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities",
      "url": "https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-11-02T00:00:00Z"
    },
    {
      "id": "barracuda-campus-esg",
      "label": "Barracuda Campus: ESG remediation for CVE-2026-116606 and CVE-2026-111560",
      "url": "https://documentation.campus.barracuda.com/wiki/spaces/BSFv51/pages/963739728",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-11-02T00:00:00Z"
    },
    {
      "id": "barracuda-campus-patches",
      "label": "Barracuda Campus: How to Apply the Latest Firmware Patches (ESG)",
      "url": "https://campus.barracuda.com/product/emailsecuritygateway/doc/171807307/how-to-apply-the-latest-firmware-patches/",
      "sourceType": "other_primary",
      "observedAt": "2026-11-02T00:00:00Z"
    },
    {
      "id": "mandiant-0042",
      "label": "Mandiant MNDT-2026-0042 (CVE-2026-116606)",
      "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-11-02T00:00:00Z"
    },
    {
      "id": "mandiant-0041",
      "label": "Mandiant MNDT-2026-0041 (CVE-2026-111560)",
      "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-11-02T00:00:00Z"
    },
    {
      "id": "cve-116606",
      "label": "CVE-2026-116606 CVE record",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-116606",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-11-02T12:59:11Z"
    },
    {
      "id": "cve-111560",
      "label": "CVE-2026-111560 CVE record",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111560",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-11-02T12:59:03Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL: Barracuda Email Security Gateway no-login-to-root chain, fix and exposure check",
      "url": "https://hol.org/blog/cve-2026-116606-barracuda-email-security-gateway-auth-bypass-root",
      "sourceType": "other_primary",
      "observedAt": "2026-11-02T14:28:29Z"
    }
  ],
  "artifacts": [
    {
      "id": "barracuda-esg",
      "artifactClass": "package",
      "ecosystem": "generic",
      "name": "Barracuda Email Security Gateway (ESG)",
      "version": "CVE-2026-116606: < 9.4.0.030 (CVE record); CVE-2026-111560: <= 9.4.0.27",
      "defanged": false
    },
    {
      "id": "barracuda-other-appliances",
      "artifactClass": "package",
      "ecosystem": "generic",
      "name": "Barracuda Load Balancer ADC, WAF, WSG, Message Archiver, WAF Control Center",
      "version": "CVE-2026-111560 only: ADC <= 6.4.0, WAF <= 11.0.1, WSG <= 16.1.100.100, BMA <= 5.5.4.0, WCC <= 2.2.1",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "cmd-injection-reported",
      "occurredAt": "2026-10-15T00:00:00.000Z",
      "eventType": "other",
      "summary": "Mandiant timeline: CVE-2026-111560 (timezone command injection) reported by Barracuda.",
      "sourceIds": [
        "mandiant-0041"
      ]
    },
    {
      "id": "auth-bypass-reported",
      "occurredAt": "2026-10-22T00:00:00.000Z",
      "eventType": "other",
      "summary": "Mandiant timeline: CVE-2026-116606 (ESG authentication bypass via configuration import) reported by Barracuda.",
      "sourceIds": [
        "mandiant-0042"
      ]
    },
    {
      "id": "barracuda-advisory",
      "occurredAt": "2026-11-02T00:00:00.000Z",
      "eventType": "disclosure",
      "summary": "Barracuda publishes its Trust Center advisory and Campus remediation pages with patch IDs for ESG, ADC, BMA, WCC, WAF and WSG.",
      "sourceIds": [
        "barracuda-advisory",
        "barracuda-campus-esg"
      ]
    },
    {
      "id": "cve-records-published",
      "occurredAt": "2026-11-02T12:59:11.278Z",
      "eventType": "disclosure",
      "summary": "CVE records for CVE-2026-111560 and CVE-2026-116606 published alongside Mandiant advisories MNDT-2026-0041 and MNDT-2026-0042.",
      "sourceIds": [
        "cve-116606",
        "mandiant-0042",
        "mandiant-0041"
      ]
    },
    {
      "id": "hol-blog-published",
      "occurredAt": "2026-11-02T14:28:29.561Z",
      "eventType": "other",
      "summary": "HOL Guard publishes an operator write-up with the firmware check, the Firmware Patches default, the port 8000 exposure check and scope notes.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-not-barracuda-appliance",
      "relationship": "not_covered",
      "limitation": "HOL Guard reviews AI coding agent actions on developer machines. It does not patch or inspect Barracuda appliances; the fix is a firmware update and restricting admin interface access."
    }
  ],
  "policies": [],
  "limitations": [
    "Barracuda Load Balancer ADC, WAF, WSG, Message Archiver and WAF Control Center are listed only for CVE-2026-111560, which needs administrator credentials.",
    "Barracuda's cloud email products are not in the advisory's affected product list.",
    "Exploitation requires access to the administrative interface; mail arriving on SMTP is not the stated entry point.",
    "No public exploit, no in-the-wild exploitation report and no CISA KEV listing as of 2026-11-02 (catalog 2026.10.30)."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-116606-barracuda-email-security-gateway-auth-bypass-root/corrections"
}