Barracuda critical flaws (CVE-2026-116606, CVE-2026-111560) allow root access to ESG, ADC, Message Archiver, WAF and Web Security Gateway devices

Key facts for Barracuda ESG auth bypass

Detection coverage for Barracuda ESG auth bypass

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5158 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Barracuda ESG CVE-2026-116606 Configuration Import / Backup Restore Abuse — Exploitation (Splunk SPL)

Detects configuration-import / backup-restore events on Barracuda appliances (ESG first) forwarded by syslog. CVE-2026-116606 (CWE-288, MNDT-2026-0042) lets an attacker invoke the configuration-import function and restore a crafted backup archive, modifying the appliance global configuration (T1190, T1565.001). Sources conflict on whether the flaw is pre-authentication (CVE record, Mandiant) or needs admin-interface access (Barracuda advisory, BleepingComputer), and the endpoint and archive format are undisclosed, so this is behaviour-first: every restore/import event is reviewed against change records, and events with a non-RFC1918 source are flagged via external_src (T1133, T1078). No in-the-wild exploitation is reported. Primary flavor: Splunk SPL.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1133, T1565.001, T1078
• Data sources: barracuda_syslog, linux_syslog, sentinel_syslog_table, web_access_logs
• Severity: critical
• Confidence: medium

Splunk SPL

index=network sourcetype IN ("barracuda:syslog","syslog") (host=*barracuda* OR host=*esg* OR host=*waf* OR host=*adc* OR host=*archiver* OR host=*swg* OR host=*wcc*) ```comment CVE-2026-116606 Barracuda ESG configuration-import or backup-restore abuse, T1190 T1133 T1565.001 T1078```
| regex _raw="(?i)(config(uration)?[ _-]?(import|restore)|restore[ _-]?(backup|config)|backup[ _-]?restore)"
| rex field=_raw "(?i)(?<action>config(uration)?[ _-]?(import|restore)|restore[ _-]?(backup|config)|backup[ _-]?restore)"
| rex field=_raw "(?i)(?:src|client|from|c-ip)[=: ]+(?<src_ip>\d{1,3}(?:\.\d{1,3}){3})"
| eval external_src=if(isnotnull(src_ip) AND NOT (cidrmatch("10.0.0.0/8",src_ip) OR cidrmatch("172.16.0.0/12",src_ip) OR cidrmatch("192.168.0.0/16",src_ip) OR cidrmatch("127.0.0.0/8",src_ip)),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen max(external_src) as external_src values(action) as actions values(src_ip) as src_ips by host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host count external_src first_seen last_seen actions src_ips

Microsoft KQL

// CVE-2026-116606 Barracuda ESG configuration-import / backup-restore abuse (T1190, T1133, T1565.001, T1078)
Syslog
| where TimeGenerated > ago(24h)
| where Computer matches regex @"(?i)barracuda|esg|waf|adc|archiver|swg|wcc"
| where SyslogMessage matches regex @"(?i)(config(uration)?[ _-]?(import|restore)|restore[ _-]?(backup|config)|backup[ _-]?restore)"
| extend Action = extract(@"(?i)(config(uration)?[ _-]?(import|restore)|restore[ _-]?(backup|config)|backup[ _-]?restore)", 1, SyslogMessage)
| extend SrcIp = extract(@"(?i)(?:src|client|from|c-ip)[=: ]+(\d{1,3}(?:\.\d{1,3}){3})", 1, SyslogMessage)
| extend ExternalSrc = iff(isnotempty(SrcIp) and not(ipv4_is_private(SrcIp)), 1, 0)
| summarize EventCount = count(), ExternalSrc = max(ExternalSrc), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Actions = make_set(Action, 20), SrcIps = make_set(SrcIp, 20) by Computer
| project Computer, EventCount, ExternalSrc, FirstSeen, LastSeen, Actions, SrcIps

Sigma

title: Barracuda Appliance Configuration Import or Backup Restore Request (CVE-2026-116606)
id: 5b0c1a7e-3d41-4f6a-9a10-5158b0000001
status: experimental
description: Detects POST requests to configuration-import or backup-restore functions on Barracuda appliances. CVE-2026-116606 allows restoring a crafted backup archive on ESG to modify global configuration.
references:
    - https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
    - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1133
    - attack.t1078
    - attack.impact
    - attack.t1565.001
    - cve.2026.116606
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|re: '(?i)(config(uration)?[_-]?(import|restore)|restore[_-]?(backup|config)|backup[_-]?restore)'
    condition: selection
falsepositives:
    - Authorised administrators restoring a backup or migrating an appliance
level: high

Known false positives:

• Authorised administrators restoring a backup during disaster recovery or appliance migration
• Scheduled or vendor-supported configuration sync between clustered ESG units

Tuning notes: Allow-list known admin workstation/jump-host source IPs and approved change windows. Restrict the host filter to your real appliance hostnames. Confirm the exact log message wording on a patched lab appliance and tighten the regex; escalate any event with external_src=1 or a source outside the management VLAN, and compare the post-event global configuration against a known-good export.

• 🔒 Barracuda CVE-2026-111560 Timezone Field Shell Metacharacter Injection — Exploitation (Sentinel KQL) · unlock with TL Creds
• 🔒 Barracuda ESG Global Configuration Tampering (Security Controls Disabled, Mail Forwarding or Relay Changes) — Post-Exploitation (Sentinel KQL) · unlock with TL Creds
• 🔒 Barracuda Appliance Outbound Connection to Internet on Non-Standard Port (Reverse Shell / C2) — C2 / Lateral Movement (Sentinel KQL) · unlock with TL Creds
• 🔒 Barracuda Appliance Management Interface Access from Non-Private Source — Exploitation (Sigma) · unlock with TL Creds
• 🔒 Barracuda Appliance Root Shell Spawned from Timezone Handling or Web Server Process — Post-Exploitation (Sigma) · unlock with TL Creds
• 🔒 Barracuda Appliance Tool Download and Execute (curl/wget Staging After Root Access) — C2 / Lateral Movement (Sigma) · unlock with TL Creds
• 🔒 Barracuda Appliance Post-Root Persistence (Account, SSH Key, Cron, Service) — Post-Exploitation (Splunk SPL) · unlock with TL Creds
• 🔒 Barracuda Appliance Reverse Shell and Legacy SeaSpy/Saltwater Artifacts (CVE-2026-111560 Follow-On) — C2 / Lateral Movement (Splunk SPL) · unlock with TL Creds

Indicators of compromise for Barracuda ESG auth bypass

As of 2026-11-03, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5158.

How Barracuda ESG auth bypass works

Patches are available; no in-the-wild exploitation is reported in the sources.

On 2026-11-02 Barracuda and CVE.org published two vulnerabilities, reported by Mandiant-hosted disclosures MNDT-2026-0042 and MNDT-2026-0041. CVE-2026-116606 is an authentication bypass (CWE-288, authentication bypass using an alternate path or channel) in Barracuda Email Security Gateway (ESG) versions earlier than 9.4.0.030. Per the CVE record and the Mandiant disclosure, an unauthenticated remote attacker can invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration. The CVE record scores it CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). Note a source discrepancy: the Barracuda advisory page and the BleepingComputer article state that successful exploitation requires access to the administrative interface of the affected product, while the CVE record and Mandiant text describe an unauthenticated remote attacker. Defenders should treat the management interface exposure as the key risk factor and restrict it either way. The public sources do not disclose the endpoint, archive format, or which settings can be changed.

CVE-2026-111560 is an OS command injection (CWE-78) caused by improper neutralization of shell metacharacters in the timezone configuration field. An authenticated administrator can supply a crafted timezone value that is later processed as a shell command and executes with root privileges. It is scored CVSS 4.0 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H). Affected versions: ESG <= 9.4.0.27, Load Balancer ADC <= 6.4.0, Web Application Firewall <= 11.0.1, Web Security Gateway <= 16.1.100.100, Message Archiver <= 5.5.4.0, and WAF Control Center <= 2.2.1. The Mandiant disclosure reports it was reported by Barracuda; the technical mechanics beyond the timezone field are not published and no proof of concept is public.

Together, a configuration-modification primitive on ESG and an admin-to-root command injection could be chained to obtain root on an ESG appliance, per Barracuda's combined guidance. Barracuda patches: ESG BNSF-40425 (9.4.017+) and BNSF-40430 (<9.4.017); Load Balancer ADC and WAF BNADC-16586; Message Archiver BNMA-32468; WAF Control Center BNWF-60060; Web Security Gateway BNYF-24789. The sources do not state in-the-wild exploitation, IOCs, or attribution. BleepingComputer notes Barracuda ESG has been a prior target: CVE-2023-2868 was exploited for over seven months with SeaSpy and Saltwater malware (about 30% of compromised devices belonged to government agencies), and CVE-2023-7102 was exploited as a zero-day by UNC4841. These are historical context, not linked to the 2026 flaws.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

Remediation for Barracuda ESG auth bypass

Patches

• ESG: BNSF-40425 (9.4.017 and later), BNSF-40430 (earlier than 9.4.017); CVE-2026-116606 fixed in 9.4.0.030
• Load Balancer ADC and Web Application Firewall: BNADC-16586
• Message Archiver: BNMA-32468
• WAF Control Center: BNWF-60060
• Web Security Gateway: BNYF-24789

Immediate actions

• Apply the vendor patches for every affected Barracuda product
• Restrict access to the administrative interface to trusted internal networks only
• Audit appliance global configuration and recent configuration-import/restore activity on ESG for unauthorized changes
• Review timezone setting values on all affected appliances for shell metacharacters

Workarounds

• Limit administrative interface reachability to trusted internal networks until patched

Longer-term hardening

• Remove management interfaces of email and web security appliances from internet exposure
• Forward appliance admin and audit logs to a SIEM and alert on configuration imports and timezone changes
• Enforce MFA and least privilege for appliance administrator accounts

Affected and fixed versions

• Barracuda Networks — Email Security Gateway
  Vulnerable versions: CVE-2026-116606: earlier than 9.4.0.030; CVE-2026-111560: <= 9.4.0.27
  Fixed in: BNSF-40425 (9.4.017+); BNSF-40430 (<9.4.017)
• Barracuda Networks — Load Balancer ADC
  Vulnerable versions: <= 6.4.0
  Fixed in: BNADC-16586
• Barracuda Networks — Web Application Firewall
  Vulnerable versions: <= 11.0.1
  Fixed in: BNADC-16586
• Barracuda Networks — Web Security Gateway
  Vulnerable versions: <= 16.1.100.100
  Fixed in: BNYF-24789
• Barracuda Networks — Message Archiver
  Vulnerable versions: <= 5.5.4.0
  Fixed in: BNMA-32468
• Barracuda Networks — WAF Control Center
  Vulnerable versions: <= 2.2.1
  Fixed in: BNWF-60060

Timeline of Barracuda ESG auth bypass

• 2026-10-15 CVE-2026-111560 (timezone command injection) reported, per Mandiant disclosure MNDT-2026-0041
• 2026-10-16 CVE-2026-111560 reserved
• 2026-10-22 CVE-2026-116606 (ESG authentication bypass) initial report, per MNDT-2026-0042
• 2026-10-26 CVE-2026-116606 reserved
• 2026-11-02 Barracuda advisory published; both CVEs published with patches BNSF-40425/40430, BNADC-16586, BNMA-32468, BNWF-60060 and BNYF-24789
• 2026-11-03 BleepingComputer reports the flaws; CVE records updated; no in-the-wild exploitation stated

Sources cited for Barracuda ESG auth bypass

• CVE-2026-116606 CVE record raw.githubusercontent.com · Advisory · 2026-11-02
• CVE-2026-111560 CVE record raw.githubusercontent.com · Advisory · 2026-11-02
• Barracuda Security Advisory: Pre-Authentication Authorization Bypass and Command Injection trust.barracuda.com · Vendor report · 2026-11-02
• MNDT-2026-0042: Barracuda ESG authentication bypass GitHub · Research · 2026-11-02
• MNDT-2026-0041: Barracuda timezone command injection GitHub · Research · 2026-11-02
• Barracuda warns of critical flaws allowing root access to devices BleepingComputer · News · 2026-11-03

More in vulnerability

• SolarWinds Dameware Command Injection Vulnerability (CVE-2026-28336)
• CVE-2026-25600: Hard-coded Cryptographic Secret in Trac d.o.o. PDBM (Process Database Manager) 1.0.0.0 Enables Administrative Credential Decryption
• Microsoft Analysis: 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation
• Android November 2026 Security Bulletin: Over 200 Vulnerabilities Patched, Including Critical Framework RCE (CVE-2026-58868)
• Docker Sandboxes (sbx CLI) Symlink Vulnerability Lets AI Agents Read/Write Host Files Outside Sandbox (CVE-2026-103916)