[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxCrJvGAVAJKbNVOQT-QjXmD3V7YO5BUnD3MJmmDpBuY":3},{"article":4,"iocs":49,"watch_terms":57,"solutions":58,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"a72ecb6f-42ef-4b11-903c-a2e5849963fd","CVE-2026-116606: Barracuda ESG Bug Chain Gives Root Access","cve-2026-116606-barracuda-esg-bug-chain-gives-root-access-3c6659","watchTowr shows a failed password change, a forged backup and a timezone string give root on Barracuda ESG. Patch to 9.4.0.030 now.","Two critical vulnerabilities in Barracuda's Email Security Gateway (ESG) allow unauthenticated attackers to gain root access. The chain involves an authorization bypass (CVE-2026-116606) and an OS command injection (CVE-2026-111560). By exploiting a failed password change, forging a backup file, and manipulating a timezone string, attackers can execute commands as root.","Barracuda ESG bug chain allows root access via failed password change and forged backup.","https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F11\u002Fcve-2026-116606-barracuda-esg-bug-chain-gives-root-access.html","https:\u002F\u002Fwww.cyberkendra.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FBarracuda-Email-Security.webp","2026-11-06T18:01:00+00:00","2026-11-06T19:00:08.12396+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Email Security Gateway (ESG)","product",{"name":21,"type":22},"Barracuda","vendor",{"name":24,"type":19},"Index.pm",{"name":26,"type":19},"Backup2.pm",{"name":28,"type":19},"fix_tz.pl",{"name":30,"type":22},"watchTowr","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},[50,54],{"type":51,"value":52,"context":53},"cve","CVE-2026-116606","Pre-authentication authorization bypass in Barracuda ESG",{"type":51,"value":55,"context":56},"CVE-2026-111560","OS command injection in Barracuda ESG, runs as root",[21,30,18],{"controls":59,"vendors":143},[60,89,114],{"slug":61,"name":62,"problem":63,"products":64},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":90,"name":91,"problem":92,"products":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":90,"product_name":111,"url":112,"description":113},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":115,"name":116,"problem":117,"products":118},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[144],{"slug":145,"name":30,"logo_path":146,"roles":147},"watchtowr","\u002Fvendor-logos\u002Fwatchtowr.png",[148],"reported_by",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":161},"barracuda-esg-bug-chain-grants-root-access-via-auth-bypass-and-command-injection","Barracuda ESG Bug Chain Grants Root Access via Auth Bypass and Command Injection","Two chained vulnerabilities in Barracuda's Email Security Gateway allow an unauthenticated attacker to fully compromise the appliance, ultimately gaining root-level command execution. The attack exploits an authorization bypass flaw triggered by a failed password change, then leverages a forged backup file with a malicious timezone string to inject OS commands. This matters because email security gateways sit at the perimeter of an organization's defenses — rooting one hands attackers access to email traffic, credentials, and potentially the broader internal network. The exploit requires no authentication, dramatically lowering the bar for attackers and meaning any internet-exposed ESG is at risk until patched.",[154,155,156,157,158,159,160],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":162,"PCI DSS Requirement 6":163,"NIST SP 800-53 SI-2: Flaw Remediation":164,"OWASP A06:2021 Vulnerable and Outdated Components":165,"CIS Control 7: Continuous Vulnerability Management":166,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":167,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":168},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; timely patching of critical infrastructure like email security gateways is an explicit obligation under this article.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches promptly, with critical patches applied within one month — the unpatched ESG vulnerabilities represent a direct violation of this control.","SI-2 requires organizations to identify, report, and correct information system flaws within defined time frames — a mature flaw remediation process would have prioritized patching this unauthenticated root access vulnerability immediately upon disclosure.","The ESG's unpatched components contained the injection and bypass flaws that enabled this attack chain, directly illustrating the risk of running outdated or unpatched security software in internet-facing roles.","Regular authenticated scanning of internet-facing appliances would have flagged CVE-2026-116606 and CVE-2026-111560 promptly, triggering remediation before attackers could exploit the chain.","A.8.8 mandates timely identification and remediation of technical vulnerabilities in systems; applying this control to the ESG appliance would have ensured the critical patches were tracked and applied before exploitation.","The authorization bypass at the heart of this chain represents a failure to enforce proper authentication controls; PR.AA requires that access to systems be authenticated and authorized, which secure implementation would have blocked the initial bypass."]