{"id":12494,"date":"2026-11-10T05:58:30","date_gmt":"2026-11-10T11:58:30","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-148-active-exploitation-in-barracuda-email-security-gateway\/"},"modified":"2026-11-10T06:01:43","modified_gmt":"2026-11-10T12:01:43","slug":"alert-2026-148-active-exploitation-of-barracuda-email-security-gateway","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-148-active-exploitation-of-barracuda-email-security-gateway\/","title":{"rendered":"Alert 2026-148 Active exploitation of Barracuda Email Security Gateway"},"content":{"rendered":"\n

Affected product(s):\u00a0<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td><\/tr>
Barracuda Email Security Gateway (ESG)<\/strong><\/td>CVE-2026-116606 and CVE-2026-111560; 9.4.0.030 or later is recommended<\/td><\/tr>
Load Balancer ADC<\/strong><\/td>Only CVE-2026-111560; all versions<\/td><\/tr>
Web Application Firewall (WAF)<\/strong><\/td>Only CVE-2026-111560; all versions<\/td><\/tr>
Web Security Gateway (WSG)<\/strong><\/td>Only CVE-2026-111560; all versions<\/td><\/tr>
Message Archiver (BMA)<\/strong><\/td>Only CVE-2026-111560; 5.2 through 5.5.4.001<\/td><\/tr>
WAF Control Center (WCC)<\/strong><\/td>Only CVE-2026-111560; all versions<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

The chain from unauthenticated access to root applies only to ESG and requires access to the administration interface.<\/p>\n\n

Description<\/h2>\n\n

Two vulnerabilities have been disclosed in Barracuda Email Security Gateway that, when chained together and combined with access to the administration interface, allow authorization controls to be bypassed and root privileges to be obtained on the appliance. CVE-2026-116606 has a CVSS score of 9.3 (critical), and CVE-2026-111560 has a CVSS score of 8.6 (high).<\/p>\n\n

CVE-2026-116606 is an unauthenticated authorization bypass (CWE-288): a remote attacker without credentials who gains access to the administration interface can invoke configuration import, restore a tampered backup file, and modify the global configuration. CVE-2026-111560 is an OS command injection (CWE-78) in the time zone field that, by itself, requires authenticated administrator access and, when the value is processed, executes commands as root.<\/p>\n\n

On Nov 9, 2026 at 23:00 (PYT), the vendor stated that it had identified exploitation activity affecting a limited number of organizations, without attributing the activity to any actor, campaign, or ransomware. A public proof of concept for the chain has been available since Nov 3, 2026. As of Nov 10, 2026, these vulnerabilities do not appear in catalogs of known exploited vulnerabilities. The vendor has not published indicators of compromise.<\/p>\n\n

Command injection also affects other Barracuda products (Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver, and WAF Control Center), which have their own patches. In these products, the vulnerability still requires authenticated administrative access; it is not claimed that the chain from unauthenticated access to root applies outside ESG.<\/p>\n\n

Mitigation<\/h2>\n\n

The vendor recommends restricting the administration interface to trusted internal networks. While fixes are being applied, it is recommended not to expose it to the Internet. Additionally:<\/p>\n\n