[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:barracuda-esg-pre-auth-bypass-chains-with-root-command":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"barracuda-esg-pre-auth-bypass-chains-with-root-command","rapid-alert","Barracuda ESG: pre-auth bypass chains with root command injection across six product lines","Barracuda disclosed CVE-2026-116606 (CVSS 9.3) and CVE-2026-111560 (CVSS 8.6) on 2 Nov 2026. Chained, they bypass authorization and give root on affected appliances. Patches are out. No active exploitation reported yet.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fbarracuda-esg-pre-auth-bypass-chains-with-root-command-dbf2dea8-cover.png","Barracuda ESG rapid alert: Your email gateway is a Barracuda? Chained, it may be root with no login.","Marcus Lenngren","2026-11-04T15:14:35.355+00:00","![Barracuda ESG rapid alert: Your email gateway is a Barracuda? Chained, it may be root with no login.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fbarracuda-esg-pre-auth-bypass-chains-with-root-command-dbf2dea8-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nOn 2 November 2026 Barracuda disclosed two vulnerabilities in its security appliances that, when chained, let an attacker bypass authorization controls and obtain root access on the device.\n\nThe first, CVE-2026-116606, is a pre-authentication authorization bypass in the Email Security Gateway (ESG). It carries a CVSS score of 9.3. It lets an attacker modify an appliance's global configuration.\n\nThe second, CVE-2026-111560, is a command injection flaw with a CVSS score of 8.6. It lets a user with admin permissions inject OS commands that run as root. It affects six product families.\n\nBarracuda labels both flaws \"High\" in its advisory despite the first scoring 9.3. The advisory also states that exploitation requires access to the administrative interface. There is a known inconsistency: Barracuda calls CVE-2026-116606 a pre-authentication bypass yet lists \"Authentication Required: Yes, administrative access.\" The published details do not clearly settle whether valid admin credentials are needed in every case. Treat the chain as potentially unauthenticated root until Barracuda clarifies.\n\nThe advisory does not report active exploitation and names no campaign. No exploit payloads, example requests or indicators of compromise have been published.\n\n## Timeline\n\n- 2 Nov 2026: Barracuda discloses both CVEs and releases patches.\n- 3 Nov 2026: Public reporting begins.\n- 4 Nov 2026: No active exploitation reported.\n\n## Am I affected?\n\nCheck which Barracuda products you run and against which flaw.\n\n- Email Security Gateway (ESG): affected by both CVE-2026-116606 and CVE-2026-111560.\n- Load Balancer ADC: affected by CVE-2026-111560 only.\n- Message Archiver (BMA): CVE-2026-111560 only.\n- WAF Control Center (WCC): CVE-2026-111560 only.\n- Web Application Firewall (WAF): CVE-2026-111560 only.\n- Web Security Gateway (WSG): CVE-2026-111560 only.\n\nOnly ESG is listed as vulnerable to the authorization bypass. Your exposure is higher if the appliance's administrative interface is reachable from the internet.\n\n## What to do now\n\n1. Confirm whether each appliance's admin interface is reachable from outside trusted internal networks. If it is, restrict it now with network access controls. This is the fastest containment step.\n2. Apply the product-specific patch. For ESG on 9.4.017 and later use BNSF-40425; on earlier versions use BNSF-40430. For ADC and WAF use BNADC-16586. For Message Archiver use BNMA-32468. For WAF Control Center use BNWF-60060. For Web Security Gateway use BNYF-24789.\n3. Verify the update actually installed. Barracuda notes that systems several firmware versions behind may need multiple updates, and that automatic patching may not have applied the fix.\n4. If auto patch did not land, install it manually and re-enable automatic patch delivery where it was disabled.\n5. Contact Barracuda Support if you cannot confirm firmware and patch status.\n\n## How to hunt\n\nBarracuda has not published any hashes, domains, IP addresses, filenames or detection signatures for these CVEs. There is no confirmed exploit method to hunt against, and the 2023 ESG attacks (CVE-2023-2868, CVE-2023-7102) are separate issues whose methods should not be applied here.\n\nUntil indicators exist, focus on access rather than malware:\n\n- Review who and what can reach each admin interface. Pull firewall and proxy logs for connections to management ports from outside trusted ranges.\n- Audit admin interface authentication logs for unexpected logins or configuration changes to the appliance's global configuration.\n- Watch for unexpected processes or shell activity running as root on the appliances, and for configuration drift.\n- Record current firmware and patch IDs so you can prove remediation.\n\n## What does not help\n\n- Assuming this is admin-only and can wait. CVE-2026-116606 is described as a pre-authentication bypass, and chained with the command injection the result may be root.\n- Applying 2023 ESG recovery or detection methods. Those flaws and their malware are not the same issue.\n- Relying on auto patch alone. Confirm the update installed on every device.\n\n## Sources\n\n- [Barracuda warns of critical flaws allowing root access to devices](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fbarracuda-warns-of-critical-flaws-allowing-root-access-to-devices\u002F), BleepingComputer, 3 Nov\n- [Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access](https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fbarracuda-flaws-could-be-chained-to.html), The Hacker News, 3 Nov\n- [Critical Barracuda Security Flaws Could Let Hackers Bypass Authentication and Gain Root Access](https:\u002F\u002Fcybersecuritynews.com\u002Fcritical-barracuda-security-flaws\u002F), Cyber Security News, 4 Nov\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"check-point-gaia-under-attack-php2shell-chained-to-root-for","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":44,"kind":6,"title":45,"excerpt":46,"cover_image_url":47,"cover_image_alt":48,"author_name":11,"published_at":49,"reading_minutes":18},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00"]