{"type":"bundle","id":"bundle--2ae0b87e-fb3f-5c55-8af9-a6023a6c2197","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--dc563b9f-eacb-5b7c-b0fe-f8d3e49f6f36","created":"2026-11-02T14:35:13.174Z","modified":"2026-11-02T14:35:13.174Z","name":"Barracuda Email Security Gateway chained from no login to root through the admin interface (CVE-2026-116606, CVE-2026-111560)","description":"Barracuda and Mandiant disclosed two bugs on 2026-11-02. CVE-2026-116606 (CVSS 4.0 9.3, CWE-288) is an authentication bypass in Barracuda Email Security Gateway (ESG) that lets an unauthenticated remote attacker invoke the configuration-import function and restore a crafted, compatible backup, modifying the appliance's global configuration. CVE-2026-111560 (CVSS 4.0 8.6, CWE-78) is an OS command injection in the timezone configuration field that runs as root and needs administrator privileges; it affects ESG, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center. Barracuda says that exploited in combination they can bypass authorization controls and give root on the device, and that exploitation requires access to the administrative interface. Barracuda's Campus page names ESG firmware 9.4.0.029 as the fix; the CVE record and Mandiant list the bypass as affecting versions earlier than 9.4.0.030. Patch IDs: ESG BNSF-40425 (9.4.017+) and BNSF-40430 (older), ADC and WAF BNADC-16586, BMA BNMA-32468, WCC BNWF-60060, WSG BNYF-24789. No exploitation reported and not on CISA KEV as of catalog 2026.10.30.","aliases":["CVE-2026-116606","CVE-2026-111560","MNDT-2026-0042","MNDT-2026-0041","Barracuda ESG authentication bypass config restore","Barracuda timezone command injection"],"first_seen":"2026-10-15T00:00:00.000Z","last_seen":"2026-11-02T14:28:29.561Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Barracuda Trust Center: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities","url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection"},{"source_name":"Barracuda Campus: ESG remediation for CVE-2026-116606 and CVE-2026-111560","url":"https://documentation.campus.barracuda.com/wiki/spaces/BSFv51/pages/963739728"},{"source_name":"Barracuda Campus: How to Apply the Latest Firmware Patches (ESG)","url":"https://campus.barracuda.com/product/emailsecuritygateway/doc/171807307/how-to-apply-the-latest-firmware-patches/"},{"source_name":"Mandiant MNDT-2026-0042 (CVE-2026-116606)","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md"},{"source_name":"Mandiant MNDT-2026-0041 (CVE-2026-111560)","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md"},{"source_name":"CVE-2026-116606 CVE record","url":"https://www.cve.org/CVERecord?id=CVE-2026-116606"},{"source_name":"CVE-2026-111560 CVE record","url":"https://www.cve.org/CVERecord?id=CVE-2026-111560"},{"source_name":"HOL: Barracuda Email Security Gateway no-login-to-root chain, fix and exposure check","url":"https://hol.org/blog/cve-2026-116606-barracuda-email-security-gateway-auth-bypass-root"}]}]}