# Barracuda CVE-2026-116606 + CVE-2026-111560 detection pack

**Disclosed:** 2 Nov 2026 by Barracuda. **Pack built:** 3 Nov 2026 (Europe/London, UTC+0).
**Audience:** UK MSPs running Microsoft Sentinel and Defender across client estates.

## Summary
Barracuda has fixed two flaws found by security researchers:

| CVE | What it is | Products | Score (who gave it) |
|---|---|---|---|
| CVE-2026-116606 | Pre-authentication authorisation bypass (CWE-288) | Email Security Gateway (ESG) only | CVSS 4.0 **9.3** (Barracuda Trust Center; same score in the CVE record from the assigning CNA, the reporting security researchers) |
| CVE-2026-111560 | OS command injection via the timezone configuration field, runs as root (CWE-78) | ESG, Load Balancer ADC, WAF, Web Security Gateway, Message Archiver, WAF Control Center | CVSS 4.0 **8.6** (Barracuda Trust Center and the CVE record) |

- Barracuda's Campus pages and news reports call the issues critical. Barracuda's own Trust Center lists both as Severity "High".
- **NVD:** both records are "Awaiting Analysis". NVD has not given its own score; the only scores shown are the CNA's (marked Secondary).
- **Exploitation:** CISA's ADP SSVC entry in both records says Exploitation "none" (Automatable "yes", Technical Impact "total"). Barracuda does not report exploitation.
- **CISA KEV:** neither CVE is listed (KEV catalog version 2026.10.30, released 30 Oct 2026, 1,766 entries; checked 3 Nov 2026). No KEV due date applies. The catalog pre-dates disclosure, so re-check it.
- **IOCs:** none have been published by Barracuda or any other source used here. **This pack contains no IOCs.** IPs in the queries and rules are RFC 5737 documentation placeholders (192.0.2.x, 198.51.100.x).

Why it matters: Barracuda ESG was mass-exploited in 2023 through CVE-2023-2868 (in CISA KEV since 26 May 2023). Appliances that sit on the edge and hold mail are high-value targets.

## How the chain works (high level)
From Barracuda (Trust Center and Campus):
- "Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device."
- Organisations whose admin interfaces are not reachable from the internet are less exposed.

From the CVE records (CVE.org / NVD, text supplied by the CNA):
- CVE-2026-116606: an unauthenticated remote attacker can invoke a configuration-import function and restore a crafted, compatible backup archive, changing the ESG's global configuration.
- CVE-2026-111560: shell metacharacters in the timezone configuration field are not neutralised, so an authenticated administrator can inject OS commands that run as root when the timezone value is processed. It sits in "common Barracuda code", which is why six products are affected.

Public reporting (news, not a primary source) describes the first flaw as letting attackers modify the global configuration and the second as letting admins inject commands that run as root. Combining the two (bypass, then a crafted timezone value) is the chain. No exploit details are given here and none are needed for the detections.

## Affected and fixed versions
Barracuda's fix for every product is a **security patch** (pushed automatically unless auto-patching is off) plus "latest firmware". Barracuda publishes a fixed firmware number **only for ESG**.

| Product | CVEs | Affected (source) | Fix (Barracuda) | Fixed firmware number |
|---|---|---|---|---|
| Email Security Gateway (ESG) | both | Barracuda: "All versions". CVE record: 116606 below 9.4.0.030; 111560 up to and including 9.4.0.27 | Patch BNSF-40425 (9.4.0.17+), BNSF-40430 (below 9.4.0.17); or firmware 9.4.0.029 | **9.4.0.029** (Barracuda) |
| Load Balancer ADC | 111560 | up to and including 6.4.0 (CVE record) | Patch BNADC-16586 + latest firmware | not published |
| Web Application Firewall (WAF) | 111560 | up to and including 11.0.1 (CVE record) | Patch BNADC-16586 (as listed by Barracuda) + latest firmware | not published |
| Web Security Gateway (WSG) | 111560 | up to and including 16.1.100.100 (CVE record) | Patch BNYF-24789 + latest firmware | not published |
| Message Archiver (BMA) | 111560 | up to and including 5.5.4.0 (CVE record) | Patch BNMA-32468 + latest firmware | not published |
| WAF Control Center (WCC) | 111560 | up to and including 2.2.1 (CVE record) | Patch BNWF-60060 + latest firmware | not published |

**ESG cut-off (9.4.0.029 vs 9.4.0.030):** Barracuda's ESG Campus article says upgrade to 9.4.0.029 and "verify that the appliance reports firmware version 9.4.0.029 or later". The CVE record for CVE-2026-116606 (and the Canadian Cyber Centre AV26-1112, which copies it) says affected "prior to 9.4.0.030". We follow the vendor: **9.4.0.029 or later = patched**. The checker still prints the discrepancy. If you want zero doubt, go to the latest firmware your appliance offers.

**Source quirks to be aware of:**
- Canadian Cyber Centre says "Prior to" each version (e.g. prior to 6.4.0). The CVE records say "less than or equal to", so the listed versions themselves are affected.
- Barracuda's ESG article says the security update covers "9.1 through 9.4.0.027" in one place and "9.1.x through 9.4.0.17" in another.
- Barracuda's Trust Center says "Authentication Required: Yes, administrative access" for CVE-2026-116606, which the same page names a pre-authentication bypass.
- Barracuda lists BNADC-16586 for both ADC and WAF.

### ESG update steps (Barracuda)
1. Web interface as admin > **Advanced > Firmware Update**; read Current Installed Version.
2. Click Update to 9.4.0.029. **Below 9.1 you must update in two steps**; you cannot jump straight to 9.4.0.029. Repeat until it reports 9.4.0.029 or later.
3. Reboot if prompted, then re-check the version.

## Proactive actions
1. **Inventory every Barracuda appliance across all client estates** (RMM, Barracuda Cloud Control, Defender device discovery via `kql` Q7, firewall NAT rules). Include virtual and cloud appliances.
2. **Patch and confirm firmware.** Check the version on each device after patching; make sure auto-patching is on. Run `scripts/check-barracuda.sh --csv inventory.csv` (or `Check-Barracuda.ps1 -Csv`) on an export.
3. **Take admin interfaces off the internet**, or limit them to management IPs / VPN (Barracuda's own advice). Use `kql` Q4 and the inbound sigma rule to prove it.
4. **Rotate admin credentials** (and any API keys) on every affected appliance, and review the admin account list.

## Reactive: what to look for
- **Unexpected timezone configuration changes**, especially values with shell characters (`kql` Q1, sigma timezone rules).
- **Unknown admin sessions or logins**, logins from new IPs, failed-then-successful auth (`kql` Q2, Q3).
- **Configuration restores/imports you did not make** (CVE-2026-116606 abuses configuration import).
- **Odd processes or outbound connections from the appliance** (`kql` Q5, outbound sigma rule).
- **New files or cron jobs** on the appliance (needs Barracuda support access to check).

### If you suspect compromise
1. Isolate the appliance (restrict network access) but **keep it powered and keep its logs**; export syslog and config.
2. Contact Barracuda Technical Support (support@barracuda.com).
3. Rebuild or replace if compromise is confirmed or cannot be ruled out. **Do not rely on the patch alone.** With ESG in 2023 (CVE-2023-2868), patching did not remove attackers who were already in.
4. Rotate every credential the appliance held or saw (admin, LDAP/AD bind, SMTP relay, API).
5. UK organisations: consider reporting to the NCSC (https://report.ncsc.gov.uk/).

## Patched does not mean clean
A patch stops new exploitation. It does not remove a backdoor, a changed config, a new admin account or a cron job planted before you patched. Hunt back to before 2 Nov 2026 for every appliance whose admin interface was reachable from the internet.

## What is in the pack
| Path | What |
|---|---|
| `kql/barracuda-hunting.kql` | 7 hunts: timezone changes (Q1), new-IP admin logins (Q2), failed-then-success (Q3), internet to admin ports (Q4), new outbound from appliances (Q5), managed hosts reaching admin UIs (Q6), Defender discovery / TVM inventory (Q7) |
| `sigma/*.yml` | 5 rules matching Q1 to Q5; `sigma/converted/kusto_no_pipeline.txt` has the Kusto output |
| `scripts/check-barracuda.sh`, `scripts/Check-Barracuda.ps1` | Offline version checkers |
| `tests/` | bash and Pester tests, fixtures, `run_all.sh` |

**The KQL has NOT been run against a live tenant.** It is syntax-reviewed only. Log fields and keywords marked `UNVERIFIED FIELD` / UNVERIFIED are assumptions: Barracuda has not published log strings for these CVEs, and CEF/syslog layouts differ per product. Admin ports (443, 8000, 8443, 22) are placeholders to set to your own.

**Sigma:** `sigma check` passes (0 errors, 0 issues). `sigma convert -t kusto --without-pipeline` works for all 5 rules. The `azure_monitor`, `sentinel_asim` and `microsoft_xdr` pipelines fail for all 5 because there is no table mapping for `product: barracuda` or `category: firewall`; add the table (CommonSecurityLog / Syslog) yourself.

## Checkers
Strictly **read-only and offline**: they only compare version strings, a CSV and an exported syslog file you give them. They never contact an appliance, never touch its admin interface or timezone setting, send no network traffic, contain no exploit payloads and write no files.

```
scripts/check-barracuda.sh --product ESG --version 9.4.0.027
scripts/check-barracuda.sh --csv inventory.csv --syslog exported-syslog.log
pwsh scripts/Check-Barracuda.ps1 -Product WAF -Version 11.0.1
pwsh scripts/Check-Barracuda.ps1 -Csv inventory.csv -Syslog exported-syslog.log
```
CSV columns: `name,product,version` (e.g. exported from your RMM or Barracuda Cloud Control). Product accepts ESG/ADC/WAF/WSG/BMA/WCC or the full names.

Verdicts (confirmed data only):
- **PATCHED**: ESG 9.4.0.029 or later.
- **LIKELY VULNERABLE**: ESG below 9.4.0.029 (flagged **two-step update** below 9.1); other products at or below the CVE record's affected version. A device may already have the security patch without a firmware change, so confirm in the UI.
- **UNKNOWN**: other products above the affected range (Barracuda gives no fixed firmware number to confirm against), unknown products, unparseable versions.

Exit codes: 0 all PATCHED, 1 any LIKELY VULNERABLE, 2 any UNKNOWN (none vulnerable), 3 error. Both print the KEV status. The syslog option counts lines mentioning the timezone and admin logins; keywords are UNVERIFIED and a count is not evidence of compromise.

Tests: `tests/run_all.sh` (shellcheck, PSScriptAnalyzer, bash tests, Pester, sandboxed no-network read-only run, sigma check).

## Sources
- Barracuda Trust Center advisory: https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
- Barracuda Campus, Security Updates Available for Certain Barracuda Products: https://documentation.campus.barracuda.com/wiki/spaces/CP/pages/960921759/Security+Updates+Available+for+Certain+Barracuda+Products
- Barracuda Campus, ESG article: https://documentation.campus.barracuda.com/wiki/spaces/BSFv51/pages/963739728
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-116606 and https://nvd.nist.gov/vuln/detail/CVE-2026-111560 (NVD API 2.0 checked 3 Nov 2026)
- CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-116606 and https://www.cve.org/CVERecord?id=CVE-2026-111560
- CISA KEV feed (catalog 2026.10.30): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- Canadian Centre for Cyber Security AV26-1112: https://www.cyber.gc.ca/en/alerts-advisories/barracuda-networks-security-advisory-av26-1112