Barracuda ESG and appliance flaws now exploited, added to CISA KEV
Barracuda says attackers have chained an ESG authentication bypass with a command injection bug against a small number of organizations. CISA gave federal agencies three days to patch.
On this page
Barracuda has confirmed that two of its recently patched vulnerabilities are being exploited in the wild, and CISA added both to its Known Exploited Vulnerabilities catalog on Tuesday. The vendor's advisory, first published November 2, was updated a week later to say threat actors have been exploiting the pair against a small number of organizations.
The two bugs are meant to be used together. One gets you in, the other gets you root.
What happened
The first flaw is an authentication bypass in Barracuda Email Security Gateway (ESG), rated 9.3 under CVSS 4.0 by Mandiant as the CNA. An unauthenticated remote attacker can reach a configuration-import function and restore a crafted, compatible backup archive, which changes the appliance's global configuration. The affected range is ESG versions earlier than 9.4.0.030.
The second is an OS command injection bug rated 8.6. It lives in the timezone configuration field, where shell metacharacters aren't neutralized properly. An authenticated administrator can plant commands there that run with root privileges when the crafted timezone value is processed later. It affects ESG up to 9.4.0.27, Load Balancer Application Delivery Controller (ADC) up to 6.4.0, Web Application Firewall (WAF) up to 11.0.1, Web Security Gateway (WSG) up to 16.1.100.100, Message Archiver (BMA) up to 5.5.4.0, and WAF Control Center (WCC) up to 2.2.1.
Barracuda's own summary of the chain, quoted by SecurityWeek: "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device."
CISA's KEV entries carry a due date of November 13, three days after the November 10 addition, under BOD 26-04. The required action is to apply vendor mitigations, follow the directive's guidance for cloud services or stop using the product where no mitigation exists, and complete the forensics triage steps CISA published alongside the directive.
How the chain works
Read the two descriptions together and the shape is fairly plain. The bypass removes the need for credentials to reach the import function, so the attacker doesn't need a valid admin login to rewrite the appliance's configuration. The command injection then needs an administrator context, which the modified configuration can supply. The timezone field is the delivery point: it's a setting that looks harmless, gets stored, and is processed later by something running as root.
That delay matters for defenders. A crafted timezone value sitting in a config isn't obviously malicious on a quick look, and the command fires when the value is next handled rather than at the moment it's written.
HackZoneLabs assessment
The severity numbers here are less interesting than the exposure question. Both bugs are in the management plane of mail and traffic appliances, and the practical precondition for the chain is that someone can reach the Admin UI. Barracuda's advice, repeated by SecurityWeek, is to keep administrative interfaces off the internet and restrict them to trusted internal networks. That's the control we'd check first, before patch status, because an ESG with its admin interface open is a different risk class from one behind a jump host.
We'd also treat the "small number of organizations" line with some care. It's the vendor's characterization and nobody has published the underlying numbers. Previdian's observation of 17 attempts against the ESG bypass between November 9 and November 11, from 15 IP addresses in three countries, is a scan-level signal rather than a victim count, and it says nothing about how many of those attempts landed. The gap between "attempts observed" and "organizations compromised" is where most of the useful information would be, and it isn't public.
The other thing worth flagging: the command injection touches six products, but the exploitation Barracuda describes is against ESG. Operators running ADC, WAF, WSG, BMA or WCC should patch on the version boundaries above, but we haven't seen anything suggesting those products are being hit in this campaign.
What remains unknown
Barracuda and CISA haven't published exploitation details: no initial access vector beyond the Admin UI precondition, no indicator list, no statement on what attackers did after root. The KEV entries list ransomware use as unknown. The patch status field in the vulnerability records is also marked unknown, which is an annotation rather than a vendor statement, so treat "recently patched" as the reporting's framing and confirm the fixed build for your product against Barracuda's advisory.
Defensive priorities
- Check whether any Barracuda Admin UI is reachable from the internet. That's the precondition for the chain.
- Inventory ESG, ADC, WAF, WSG, BMA and WCC against the version boundaries above and move to a fixed build.
- If an ESG has been internet-exposed on an affected version, assume the configuration may have been altered and review it rather than only patching.
- Follow CISA's forensics triage guidance for KEV-listed bugs if you're in scope for BOD 26-04.
CVE references
Sources
- Recently Patched Barracuda Vulnerabilities Exploited in AttacksPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning