Barracuda Email Security Gateway (ESG) qurilmalarida avtorizatsiya nazoratini chetlab o‘tish va root huquqlarini qo‘lga kiritish imkonini beradigan ikkita zaiflikni tuzatish uchun xavfsizlik yamoqlarini chiqardi.
Ushbu zaifliklar — CVE-2026-116606 va CVE-2026-111560 — hujumchilardan qurilmaning ma’muriy interfeysiga kirishni talab qiladi. Shuning uchun boshqaruv interfeysining ochiqligi ushbu kamchiliklar bilan bog‘liq xavfni baholashda muhim omildir.
2-noyabrda e’lon qilingan maslahat CVE-2026-116606 ni oldindan autentifikatsiyasiz avtorizatsiya chetlab o‘tish (pre-auth authorization bypass) sifatida tavsiflaydi, CVSS balli 9.3. CVE-2026-111560 esa buyruq in’eksiyasi (command injection) zaifligi bo‘lib, balli 8.6. Ikkalasi ham ESG’ga ta’sir qiladi — bu mahsulot avvalroq alohida Barracuda nol-kun zaifligi orqali nishonga olingan edi. Yana beshta mahsulot oilasi faqat yangi e’lon qilingan buyruq in’eksiyasi muammosidan ta’sirlanadi, to‘liq ikki zaiflik zanjiridan emas.
Avtorizatsiya chetlab o‘tish ESG’ning 9.4.0.030 dan oldingi versiyalariga ta’sir qiladi. Milliy Zaifliklar Ma’lumotlar Bazasiga ko‘ra, autentifikatsiyalanmagan masofaviy hujumchi konfiguratsiya import funksiyasini chaqirib, maxsus tayyorlangan, mos keladigan zaxira arxivini tiklashi mumkin.
Muvaffaqiyatli ekspluatatsiya qurilmaning global konfiguratsiyasini ruxsatsiz o‘zgartirishga imkon beradi. Buyruq in’eksiyasi zaifligi bilan birgalikda bu kamchilik ruxsatsiz konfiguratsiya o‘zgarishlaridan root huquqli operatsion tizim buyruqlariga o‘tish imkonini berishi mumkin.
Ma’muriy interfeysga kirish hali ham shart bo‘lib qoladi, lekin tarmoq yetib borishi (reachability) haqiqiy hisob ma’lumotlari bilan adashtirilmasligi kerak. Avtorizatsiya chetlab o‘tish aynan oldindan autentifikatsiya nazoratini buzadi.
Barracuda buyruq in’eksiyasi ekspluatatsiyasi bo‘yicha avvalgi tadqiqot CVE-2023-2868 ga tegishli edi — bu boshqa zaiflik. Boshqaruv interfeyslarini umumiy internetdan yiroq tutish yangi e’lon qilingan hujum yo‘liga duchor bo‘lishni kamaytiradi. Biroq bu yamoqlarni o‘rnatish zaruratini yo‘q qilmaydi.
ESG uchun Barracuda 9.4.017 va undan keyingi versiyalar uchun BNSF-40425, avvalgi versiyalar uchun BNSF-40430 yamoqlarini ro‘yxatga oladi. Buyruq in’eksiyasi tuzatishlari qatoriga Load Balancer Application Delivery Controller va Web Application Firewall uchun BNADC-16586, Message Archiver uchun BNMA-32468, WAF Control Center uchun BNWF-60060 va Web Security Gateway uchun BNYF-24789 kiradi. Ma’murlar har bir o‘rnatilgan mahsulotga mos yamoqni qo‘llashlari kerak.
Barracuda qurilmalari avvalroq nishonga olingan ekspluatatsiyaga duch kelgan, jumladan UNC4841 bilan bog‘liq alohida ESG nol-kun zaifligi. Ushbu tarixiy hodisalar qurilma xavfsizligining muhimligini ta’kidlaydi.
Biroq ular yangi e’lon qilingan zaifliklarning faol ekspluatatsiyasini tasdiqlamaydi. Tashkilotlar tasdiqlangan texnik ta’sirni buzilish dalillaridan ajratib, xavfni baholash va javob ustuvorliklarini aniqlashda farqlashlari kerak.
Barracuda ma’muriy kirishni ishonchli ichki tarmoqlar bilan cheklashni va tegishli tarmoq kirish nazoratini joriy etishni tavsiya qiladi. Mijozlar faqat dasturiy ta’minot yangilanishiga ishonmasdan, o‘zlarining dasturiy ta’minot versiyasi va yamoq o‘rnatish holatini tekshirishlari kerak. Juda eskirgan dasturiy ta’minot ishlatayotgan qurilmalar ketma-ket bir nechta yangilanishlarni talab qilishi mumkin, zarur hollarda qo‘llab-quvvatlash yordami bilan.
Agar avtomatik yamoqlash o‘chirilgan bo‘lsa yoki yangilanish hali kelmagan bo‘lsa, ma’murlar tegishli tuzatishni qo‘lda va tezkor ravishda qo‘llashlari kerak. Barracuda Campus tuzatish yo‘riqnomasi dasturiy ta’minotni yangilash va yamoq o‘rnatish bo‘yicha mahsulotga xos ko‘rsatmalarni taqdim etadi. Tashkilotlar ochiq ESG boshqaruv interfeyslarini ustuvor qilishlari va o‘z inventaridagi har bir ta’sirlangan qurilma bo‘yicha tuzatishni tekshirishlari kerak.
SOC’ga tezkor hodisalarni to‘xtatish uchun ogohlantirish kontekstini bering.16K SOC’dan tahdid razvedkasini integratsiya qiling.
Barracuda has released security patches for two vulnerabilities that could be exploited to bypass authorization controls and gain root access to affected Email Security Gateway (ESG) appliances.
These vulnerabilities, identified as CVE-2026-116606 and CVE-2026-111560, require attackers to access the device’s administrative interface. Therefore, the exposure of the management interface is a crucial factor in assessing the risk associated with these flaws.
The advisory, published November 2, identifies CVE-2026-116606 as a pre-authentication authorization bypass with a CVSS score of 9.3. CVE-2026-111560 is a command injection vulnerability with a score of 8.6. Both affect ESG, a product previously targeted through a separate Barracuda zero-day vulnerability. Five additional product families are affected only by the newly disclosed command injection issue, not the full two-flaw chain.
The authorization bypass affects ESG versions earlier than 9.4.0.030. According to the National Vulnerability Database, an unauthenticated remote attacker can invoke the configuration-import function and restore a crafted, compatible backup archive.
Successful exploitation allows unauthorized modification of the appliance’s global configuration. Combined with the command injection vulnerability, this weakness could enable escalation from unauthorized configuration changes to root-privileged operating system commands.
Administrative interface access remains a prerequisite, but network reachability should not be mistaken for valid credentials. The authorization bypass specifically undermines pre-authentication controls.
Earlier research into a Barracuda command injection exploit concerned CVE-2023-2868, a different vulnerability. Keeping management interfaces inaccessible from the public internet reduces exposure to the newly disclosed attack path. However, it does not eliminate the need for patches.
For ESG, Barracuda lists patches BNSF-40425 for versions designated 9.4.017 and later, and BNSF-40430 for earlier versions. The command injection fixes include BNADC-16586 for Load Balancer Application Delivery Controller and Web Application Firewall, BNMA-32468 for Message Archiver, BNWF-60060 for WAF Control Center, and BNYF-24789 for Web Security Gateway. Administrators should match the applicable patch to each deployed product.
Barracuda appliances have previously faced targeted exploitation, including a separate ESG zero-day linked to UNC4841. Those historical incidents underscore the importance of appliance security.
However, they do not establish active exploitation of these newly disclosed vulnerabilities. Organizations should distinguish confirmed technical exposure from evidence of compromise when communicating risk and determining their response priorities.
Barracuda recommends restricting administrative access to trusted internal networks and enforcing appropriate network access controls. Customers should verify both their firmware version and patch installation status, rather than assuming that a firmware update alone confirms complete remediation. Devices running substantially outdated firmware may require multiple sequential updates, with support assistance where necessary.
If automatic patching is disabled or an update has not arrived, administrators should apply the relevant fix manually and promptly. The Barracuda Campus remediation guidance provides product-specific instructions for firmware upgrades and patch installation. Organizations should prioritize exposed ESG management interfaces while verifying remediation across every affected appliance in their inventory.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.