# Barracuda CVE-2026-116606 + CVE-2026-111560 detection pack

**Disclosed:** 2 Nov 2026 by Barracuda. **Pack built:** 3 Nov 2026. **Refreshed:** 10 Nov 2026, sources re-checked 17:05 GMT and again 19:10 GMT after the CISA KEV addition (Europe/London, UTC+0).
**Status:** EXPLOITED, and both CVEs are now in CISA KEV. Barracuda reports exploitation activity affecting a small number of organizations (Trust Center update, 9 Nov 2026 9:00pm EST, which is 02:00 GMT on 10 Nov 2026) and does not say which CVE. CISA added BOTH CVEs to KEV on 10 Nov 2026 (catalog 2026.11.10, released 19:03 GMT), forensic triage required, due 13 Nov 2026 (US federal agencies only). Severity is unchanged: Barracuda rates both flaws High.
**Audience:** UK MSPs running Microsoft Sentinel and Defender across client estates.

## What changed on 10 Nov 2026 (second refresh, 19:10 GMT): CISA KEV
- **Both CVEs added to CISA KEV.** KEV catalog version 2026.11.10, released 10 Nov 2026 19:03 GMT (feed timestamp 2026-11-10T19:03:29Z), 1,779 entries. CVE-2026-116606 and CVE-2026-111560 both show Date Added 2026-11-10, Due Date 2026-11-13, "Forensic triage required per BOD 26-04: Yes", Known ransomware campaign use "Unknown". The KEV feed gives a date added, not a time; 19:03 GMT is the catalog release time.
- **CISA's required action** (KEV entry): "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk ... guidance and CISA's "Forensics Triage Requirements" ... Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable."
- **The due date binds US federal agencies only** (BOD 26-04). It is not a deadline for UK MSPs or their clients. **Patch now regardless.**
- **Who says what about exploitation.** CISA now lists both CVEs as known exploited. Barracuda's advisory still says only "We have identified exploitation activity affecting a small number of organizations" and does not name a CVE or say the flaws were chained. Do not read the KEV listing as Barracuda saying both were exploited. CISA's KEV descriptions add "This vulnerability can be chained with" the other CVE; that is CISA's description of what is possible, and Barracuda's own wording is conditional ("If exploited in combination").
- **Unchanged:** Barracuda advisory text, severity (High, CVSS 4.0 9.3 and 8.6), patch IDs, ESG firmware 9.4.0.029, NVD status (Awaiting Analysis, last modified 3 Nov 2026, no KEV fields yet), CVE.org records (last updated 3 Nov 2026; CISA ADP SSVC still says Exploitation "none", now out of date). Still no IOCs from Barracuda or CISA.
- **Pack changes:** README, KQL header comments and both checkers' KEV and exploitation lines updated; ESG checker message now maps BNSF-40425 and BNSF-40430 to firmware ranges; bash and Pester tests now assert the KEV listing, the forensic triage line, the federal-only due date, and that the stale "not in KEV" text is gone. No hunts or Sigma rules added (Q1 to Q8 already cover the room's reactive list); hunt IDs unchanged.

## What changed on 10 Nov 2026 (first refresh, 17:05 GMT)
- **Exploitation confirmed by Barracuda.** The Trust Center advisory banner reads: "Updated November 9, 2026, at 9:00pm EST: We added information about exploitation activity that has been observed affecting a small number of organizations." The advisory body now says: "We have identified exploitation activity affecting a small number of organizations." Barracuda does not say which of the two CVEs was exploited, or whether they were chained.
- **Still no IOCs.** Barracuda's updated advisory and Campus pages publish no IOCs, file paths, process names, IPs, hashes or log strings (re-checked 10 Nov 2026, 17:05 GMT). This pack still contains no IOCs.
- **Authentication wording changed (5 Nov 2026, 2:30pm EST).** Barracuda changed "Authentication Required" for CVE-2026-116606 from "Yes, administrative access" to "No (Administrative UI Access Required)": "Authentication is not required to exploit this vulnerability; however, exploitation requires the administrative user interface (Admin UI) to be accessible to the attacker." CVE-2026-111560 stays "Yes (Administrative Access)".
- **Severity unchanged.** Both stay High on the Trust Center (CVSS 4.0 9.3 and 8.6). The new fact is exploitation, not a severity change.
- **Fixes unchanged.** ESG firmware 9.4.0.029 and the same patch IDs. New Barracuda wording: apply the patch manually if it has not been applied automatically, and turn automatic patching back on if it is off.
- **Pack changes:** README refreshed; checkers now print the exploitation status and the 10 Nov KEV check, count configuration restore or import lines in an exported syslog, and skip `#` comment rows in a CSV; new KQL hunt Q8 and Sigma rule for configuration restore or import events (our hunting pattern); new offline KQL parse test; `tests/run_all.sh` now fails hard on every gate.

## Summary
Barracuda has fixed two flaws found by security researchers, and now reports exploitation activity (it does not say which CVE, or whether both were chained):

| CVE | What it is | Products | Score (who gave it) |
|---|---|---|---|
| CVE-2026-116606 | Pre-authentication authorisation bypass (CWE-288) | Email Security Gateway (ESG) only | CVSS 4.0 **9.3** (Barracuda Trust Center; same score in the CVE record from the assigning CNA, the reporting security researchers) |
| CVE-2026-111560 | OS command injection via the timezone configuration field, runs as root (CWE-78) | ESG, Load Balancer ADC, WAF, Web Security Gateway, Message Archiver, WAF Control Center | CVSS 4.0 **8.6** (Barracuda Trust Center and the CVE record) |

- **Severity: High.** Barracuda's Trust Center lists both as Severity "High" and we follow Barracuda. On 3 Nov some Barracuda Campus text and news headlines called the issues critical; the Campus pages fetched on 10 Nov carry no severity label, and BleepingComputer's 10 Nov headline still calls the flaws critical. The CVE record shows the standard CVSS 4.0 band for a 9.3; Barracuda's own label remains High.
- **Exploitation (Barracuda, re-checked 10 Nov 2026 19:10 GMT):** "We have identified exploitation activity affecting a small number of organizations." (Trust Center, updated 9 Nov 2026 9:00pm EST.) Barracuda does not say which CVE, or whether they were chained.
- **Exploitation (CISA):** both CVEs are in KEV since 10 Nov 2026 (catalog 2026.11.10). That is CISA's listing, not a Barracuda statement about each CVE.
- **Exploitation (other sources):** the Canadian Centre for Cyber Security updated AV26-1112 on 9 Nov 2026 (Update 1): "Open source reporting indicates that CVE-2026-116606 is exploited in the wild." The CVE records lag: CISA's ADP SSVC entry in both records (dated 2 Nov 2026, unchanged at 19:10 GMT on 10 Nov) still says Exploitation "none" (Automatable "yes", Technical Impact "total"). Treat that field as out of date.
- **NVD (API 2.0, checked 10 Nov 2026 17:05 and 19:10 GMT):** both records still "Awaiting Analysis", last modified 3 Nov 2026, and do not yet show the KEV listing. NVD has not given its own score; the only scores shown are the CNA's (marked Secondary). CWE-288 and CWE-78 unchanged. CVE.org records are unchanged since 3 Nov.
- **CISA KEV:** BOTH CVEs listed (catalog 2026.11.10, released 10 Nov 2026 19:03 GMT, 1,779 entries; checked 19:10 GMT). Date added 10 Nov 2026, due 13 Nov 2026, forensic triage required. On the 17:05 GMT check (catalog 2026.11.09) neither was listed; that is no longer true. The due date applies to US federal agencies only (BOD 26-04). **Patch now regardless.**
- **IOCs:** Barracuda's advisory and the CISA KEV entries still publish no IOCs (re-checked 19:10 GMT), and no other source used here does either. **This pack contains no IOCs.** IPs in the queries and rules are RFC 5737 documentation placeholders (192.0.2.x, 198.51.100.x).

Why it matters: Barracuda ESG was mass-exploited in 2023 through CVE-2023-2868 (in CISA KEV since 26 May 2023). Appliances that sit on the edge and hold mail are high-value targets.

## How the chain works (high level)
From Barracuda (Trust Center and Campus):
- "Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device."
- Organisations whose admin interfaces are not reachable from the internet are less exposed.
- Since 5 Nov, Barracuda lists CVE-2026-116606 as "Authentication Required: No (Administrative UI Access Required)" and CVE-2026-111560 as "Yes (Administrative Access)". So the bypass needs network reach to the Admin UI but no credentials.

From the CVE records (CVE.org / NVD, text supplied by the CNA):
- CVE-2026-116606: an unauthenticated remote attacker can invoke a configuration-import function and restore a crafted, compatible backup archive, changing the ESG's global configuration.
- CVE-2026-111560: shell metacharacters in the timezone configuration field are not neutralised, so an authenticated administrator can inject OS commands that run as root when the timezone value is processed. It sits in "common Barracuda code", which is why six products are affected.

Public research (news, not a primary source): BleepingComputer describes the first flaw as letting attackers modify the global configuration and the second as letting admins inject commands that run as root. Its 10 Nov article describes the second flaw as usable by unauthenticated attackers; Barracuda says CVE-2026-111560 needs administrative access, and we follow Barracuda. Combining the two (bypass, then a crafted timezone value) is the chain. No exploit details are given here and none are needed for the detections.

## Affected and fixed versions
Barracuda's fix for every product is a **security patch** (pushed automatically unless auto-patching is off) plus "latest firmware". Barracuda publishes a fixed firmware number **only for ESG**. Re-checked 10 Nov 2026 19:10 GMT: versions and patch IDs are unchanged, and all six patch IDs below match the Trust Center table.

| Product | CVEs | Affected (source) | Fix (Barracuda) | Fixed firmware number |
|---|---|---|---|---|
| Email Security Gateway (ESG) | both | Barracuda: "All versions". CVE record: 116606 below 9.4.0.030; 111560 up to and including 9.4.0.27 | Patch BNSF-40425 (Trust Center: "9.4.017+"), BNSF-40430 (Trust Center: "<9.4.017"); or firmware 9.4.0.029 | **9.4.0.029** (Barracuda) |
| Load Balancer ADC | 111560 | up to and including 6.4.0 (CVE record) | Patch BNADC-16586 + latest firmware | not published |
| Web Application Firewall (WAF) | 111560 | up to and including 11.0.1 (CVE record) | Patch BNADC-16586 (as listed by Barracuda) + latest firmware | not published |
| Web Security Gateway (WSG) | 111560 | up to and including 16.1.100.100 (CVE record) | Patch BNYF-24789 + latest firmware | not published |
| Message Archiver (BMA) | 111560 | up to and including 5.5.4.0 (CVE record) | Patch BNMA-32468 + latest firmware | not published |
| WAF Control Center (WCC) | 111560 | up to and including 2.2.1 (CVE record) | Patch BNWF-60060 + latest firmware | not published |

**ESG cut-off (9.4.0.029 vs 9.4.0.030):** Barracuda's ESG Campus article says upgrade to 9.4.0.029 and "verify that the appliance reports firmware version 9.4.0.029 or later". The CVE record for CVE-2026-116606 (and the Canadian Cyber Centre AV26-1112, which copies it) says affected "prior to 9.4.0.030". We follow the vendor: **9.4.0.029 or later = patched**. The checker still prints the discrepancy. If you want zero doubt, go to the latest firmware your appliance offers.

**Source quirks to be aware of:**
- Canadian Cyber Centre says "Prior to" each version (e.g. prior to 6.4.0). The CVE records say "less than or equal to", so the listed versions themselves are affected.
- Barracuda's ESG article says the security update covers "9.1 through 9.4.0.027" in one place and "9.1.x through 9.4.0.17" in another.
- Barracuda's Trust Center said "Authentication Required: Yes, administrative access" for CVE-2026-116606 on 3 Nov, which clashed with "pre-authentication". Barracuda fixed this on 5 Nov: it now says "No (Administrative UI Access Required)".
- The per-CVE "Advisory Updated" fields on the Trust Center still say November 2, 2026, even though the page banner records updates on 5 and 9 Nov.
- Barracuda lists BNADC-16586 for both ADC and WAF.
- The Trust Center writes the ESG patch split as "9.4.017" while the Campus ESG article writes "9.4.0.17". We read them as the same build; the checker quotes the Trust Center form.
- CISA's KEV entry for CVE-2026-111560 lists "Load Balancer, Application Delivery Controller (ADC)" as two names; Barracuda lists one product, Load Balancer ADC. We follow Barracuda (six products).

### ESG update steps (Barracuda)
1. Web interface as admin > **Advanced > Firmware Update**; read Current Installed Version.
2. Click Update to 9.4.0.029. **Below 9.1 you must update in two steps**; you cannot jump straight to 9.4.0.029. Repeat until it reports 9.4.0.029 or later.
3. Reboot if prompted, then re-check the version.

## Proactive actions
**Barracuda's advice (Trust Center, re-checked 10 Nov 2026 19:10 GMT):**
- Verify every affected device runs the latest firmware and has all security patches. If firmware is several versions behind, more than one update may be needed.
- "If a patch has not been automatically applied, customers should manually apply the appropriate patch as soon as possible. If customers have turned off automatic patching, Barracuda recommends setting devices to automatically receive patches."
- Restrict access to administrative interfaces to trusted internal networks and use network access controls to limit exposure.
- Contact Barracuda Support (support@barracuda.com) for help verifying firmware or applying the patch.

**CISA's advice (KEV entry and BOD 26-04 guidance):**
- Apply mitigations per vendor instructions, perform forensic triage, and discontinue use of the product if mitigations are unavailable. Due 13 Nov 2026, which binds US federal agencies only.
- CISA's forensic triage guidance for agencies has six steps: scoping, preserving and collecting evidence, patching and stabilisation, containment and control, triage analysis, and an escalation decision. It says not to alter or remediate systems before evidence collection when possible. Non-federal organisations can use it as a reference.

**Our advice (ours, not Barracuda's or CISA's):**
1. **Patch now.** Barracuda reports exploitation and CISA lists both CVEs in KEV. Do not wait for the 13 Nov KEV date (it is for US federal agencies) or an NVD score. Where you can, export logs and config first (see CISA's evidence step) but do not let that delay the patch on an internet-exposed appliance.
2. **Inventory every Barracuda appliance across all client estates** (RMM, Barracuda Cloud Control, Defender device discovery via `kql` Q7, firewall NAT rules). Include virtual and cloud appliances.
3. **Confirm the patch landed.** Check the version on each device; run `scripts/check-barracuda.sh --csv inventory.csv` (or `Check-Barracuda.ps1 -Csv`) on an export.
4. **Prove the Admin UI is off the internet** with `kql` Q4 and the inbound sigma rule, and allow only management IPs or VPN.
5. **Rotate admin credentials** (and any API keys) on every affected appliance, and review the admin account list.

## Reactive: what to look for
Barracuda has published no compromise indicators or hunting guidance for these CVEs. CISA requires forensic triage for federal agencies (see above) but publishes no CVE-specific triage steps or IOCs in the KEV entries. Everything in this section is our hunting guidance, based on how the CVE records describe the flaws.
- **Configuration restores or imports you did not make**, or any unexpected change to the global configuration (CVE-2026-116606 abuses configuration import; `kql` Q8, sigma `barracuda_config_restore_import.yml`, checker `--syslog` count).
- **Unexpected timezone configuration changes**, especially values with shell characters (`kql` Q1, sigma timezone rules).
- **Unknown admin sessions or logins**, logins from new IPs, failed-then-successful auth (`kql` Q2, Q3).
- **Odd processes or outbound connections from the appliance** (`kql` Q5, outbound sigma rule).
- **Unexpected root-level processes, new files or cron jobs** on the appliance (needs Barracuda support access to check).

### If you suspect compromise (our advice; Barracuda's only stated contact route is support@barracuda.com; CISA's triage steps are its federal guidance)
1. Isolate the appliance (restrict network access) but **keep it powered and keep its logs**; export syslog and config.
2. Treat the device as possibly compromised and contact Barracuda Technical Support (support@barracuda.com). If the Admin UI was reachable from the internet before the patch landed, treat it as possibly compromised even with no hits.
3. Rebuild or replace if compromise is confirmed or cannot be ruled out. **Do not rely on the patch alone.** With ESG in 2023 (CVE-2023-2868), patching did not remove attackers who were already in.
4. Rotate every credential the appliance held or saw (admin, LDAP/AD bind, SMTP relay, API).
5. UK organisations: consider reporting to the NCSC (https://report.ncsc.gov.uk/).

## Patched does not mean clean
A patch stops new exploitation. It does not remove a backdoor, a changed config, a new admin account or a cron job planted before you patched. Barracuda now reports exploitation and CISA lists both CVEs in KEV, so hunt back to before 2 Nov 2026 for every appliance whose admin interface was reachable from the internet, including appliances that auto-patched.

## What is in the pack
| Path | What |
|---|---|
| `kql/barracuda-hunting.kql` | 8 hunts: timezone changes (Q1), new-IP admin logins (Q2), failed-then-success (Q3), internet to admin ports (Q4), new outbound from appliances (Q5), managed hosts reaching admin UIs (Q6), Defender discovery / TVM inventory (Q7), configuration restore or import events (Q8, added 10 Nov 2026) |
| `sigma/*.yml` | 6 rules: 5 matching Q1 to Q5, plus `barracuda_config_restore_import.yml` matching Q8 (added 10 Nov 2026); `sigma/converted/kusto_no_pipeline.txt` has the Kusto output |
| `scripts/check-barracuda.sh`, `scripts/Check-Barracuda.ps1` | Offline version checkers |
| `tests/` | bash and Pester tests, synthetic fixtures (marked FIXTURE_ONLY), `kql_parse.ps1`, `run_all.sh` |

**The KQL has NOT been run against a live tenant.** All 8 queries parse cleanly offline with Kusto.Language against an assumed subset of the CommonSecurityLog, Syslog and Defender schema (`tests/kql_parse.ps1`); that proves syntax and column names only. The queries run in Microsoft Sentinel (CommonSecurityLog, Syslog) and Microsoft Defender advanced hunting (Device tables). Log fields and keywords marked `UNVERIFIED FIELD` / UNVERIFIED are assumptions: Barracuda has not published log strings for these CVEs, and CEF/syslog layouts differ per product. Admin ports (443, 8000, 8443, 22) are placeholders to set to your own.

**Sigma:** `sigma check` passes (0 errors, 0 condition errors, 0 issues). `sigma convert -t kusto --without-pipeline` works for all 6 rules. The `azure_monitor`, `sentinel_asim` and `microsoft_xdr` pipelines fail for all 6 because there is no table mapping for `product: barracuda` or `category: firewall`; add the table (CommonSecurityLog / Syslog) yourself.

## Checkers
Strictly **read-only and offline**: they only compare version strings, a CSV and an exported syslog file you give them. They never contact an appliance, never touch its admin interface or timezone setting, send no network traffic, contain no exploit payloads and write no files.

```
scripts/check-barracuda.sh --product ESG --version 9.4.0.027
scripts/check-barracuda.sh --csv inventory.csv --syslog exported-syslog.log
pwsh scripts/Check-Barracuda.ps1 -Product WAF -Version 11.0.1
pwsh scripts/Check-Barracuda.ps1 -Csv inventory.csv -Syslog exported-syslog.log
```
CSV columns: `name,product,version` (e.g. exported from your RMM or Barracuda Cloud Control). Product accepts ESG/ADC/WAF/WSG/BMA/WCC or the full names. Rows whose first field starts with `#` are comments and are skipped.

Verdicts (confirmed data only):
- **PATCHED**: ESG 9.4.0.029 or later.
- **LIKELY VULNERABLE**: ESG below 9.4.0.029 (flagged **two-step update** below 9.1); other products at or below the CVE record's affected version. A device may already have the security patch without a firmware change, so confirm in the UI.
- **UNKNOWN**: other products above the affected range (Barracuda gives no fixed firmware number to confirm against), unknown products, unparseable versions.

Exit codes: 0 all PATCHED, 1 any LIKELY VULNERABLE, 2 any UNKNOWN (none vulnerable), 3 error. Both print the exploitation status (Barracuda, CVE not named) and the KEV status (both listed, catalog 2026.11.10, forensic triage required, due 13 Nov 2026 for US federal agencies only, patch now regardless). The syslog option counts lines mentioning the timezone, admin logins, and configuration or backup restores and imports; keywords are UNVERIFIED and a count is not evidence of compromise.

Tests: `tests/run_all.sh` fails hard on the first failed gate: ShellCheck, PSScriptAnalyzer, bash tests, Pester, no-network and no-write guards on the scripts, FIXTURE_ONLY and RFC 5737 checks on fixtures, RFC 5737 check on KQL and Sigma IPs, no em or en dashes, no Critical severity claims, bwrap sandbox runs (no network, read-only filesystem) with a sha256 of the pack before and after, offline KQL parse of all 8 queries, sigma check, and sigma convert compared against `sigma/converted/`.

## Sources
Primary sources re-checked 10 Nov 2026, 17:05 GMT and 19:10 GMT.
- Barracuda Trust Center advisory (updated 5 Nov 2026 2:30pm EST and 9 Nov 2026 9:00pm EST): https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
- Barracuda Campus, Security Updates Available for Certain Barracuda Products: https://documentation.campus.barracuda.com/wiki/spaces/CP/pages/960921759/Security+Updates+Available+for+Certain+Barracuda+Products
- Barracuda Campus, ESG article: https://documentation.campus.barracuda.com/wiki/spaces/BSFv51/pages/963739728
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-116606 and https://nvd.nist.gov/vuln/detail/CVE-2026-111560 (NVD API 2.0 checked 3 Nov and 10 Nov 2026)
- CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-116606 and https://www.cve.org/CVERecord?id=CVE-2026-111560
- CISA KEV feed (catalog 2026.11.10 checked 10 Nov 2026 19:10 GMT, both CVEs listed; 2026.11.09 at 17:05 GMT and 2026.10.30 on 3 Nov 2026, neither listed): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- CISA KEV catalog page: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CISA BOD 26-04 and its implementation guidance (forensic triage steps): https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk and https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- Canadian Centre for Cyber Security AV26-1112 (Update 1, 9 Nov 2026; re-read 10 Nov 2026 19:10 GMT, unchanged): https://www.cyber.gc.ca/en/alerts-advisories/barracuda-networks-security-advisory-av26-1112
- News, BleepingComputer, 3 Nov 2026: https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/
- News, BleepingComputer, 10 Nov 2026 (exploitation report; news only, not a source for scores, versions or IOCs): https://www.bleepingcomputer.com/news/security/hackers-exploit-barracuda-email-security-gateway-flaws-to-get-root-access/