Threat Overview
Barracuda disclosed an authorization bypass in ESG configuration restoration and a separate administrator-level command injection. watchTowr demonstrated that chaining the flaws can provide root execution without credentials where the administrative interface is reachable. The published demonstration is not proof of in-the-wild exploitation.
References
– 2026-11-02; updated 2026-11-05: https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
– 2026-11-06: https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html
Impacted Systems
Barracuda Email Security Gateway (ESG): both CVE-2026-116606 and CVE-2026-111560. Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway: CVE-2026-111560 only, requiring administrative privileges absent the ESG bypass. On-premise/virtual appliance administrative interfaces must be reachable. Vendor advises latest firmware and applicable security patches; exact first-safe build varies by product, and ESG 9.4.0.029 versus 9.4.0.030 is disputed in published materials.
Why this matters
Recent verified reporting indicates a potentially consequential enterprise threat. Layered Sentinel hunting can surface related activity where supporting logs are ingested.
Exploitation Status
Researcher-confirmed exploit chain in testing; no verified exploitation in the wild identified. No campaign-specific IOCs confirmed.
What this hunt looks for
No customer-specific Sentinel telemetry was reviewed during report preparation. The following queries are designed to assess authentication, system and endpoint process behavior, network traffic, and persistence where those data sources are ingested.
Required logs
This is a prepared hunt package, not a completed customer workspace investigation. Conclusions are limited to the tables and retention actually ingested into Microsoft Sentinel. Absence of matching activity cannot establish absence of compromise on unmonitored hosts or in non-ingested logs.
Admin interface requests involving configuration import or backup
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Raw=strcat(tostring(RequestURL)," ",tostring(Message))
| where Raw has_any ("backup","restore","import","index.cgi")
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, DeviceAction, RawRare external sources contacting management services
let Baseline=CommonSecurityLog | where TimeGenerated between (ago(30d)..ago(2d)) | summarize by SourceIP,DestinationIP,DestinationPort;
CommonSecurityLog | where TimeGenerated >= ago(2d) and isnotempty(SourceIP) | join kind=leftanti Baseline on SourceIP,DestinationIP,DestinationPort | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, RequestURLSuspicious timezone or shell metacharacters in HTTP logs
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Raw=strcat(tostring(RequestURL)," ",tostring(Message))
| where Raw has "timezone" and (Raw contains ";" or Raw contains "$(" or Raw contains "`" or Raw contains "|")
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, RawConfiguration and authentication changes in appliance Syslog
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("Barracuda","ESG","backup restore","timezone","configuration import")
| project TimeGenerated, Computer, ProcessName, SyslogMessageNew management-originated outbound network connections
let Base=CommonSecurityLog | where TimeGenerated between (ago(30d)..ago(2d)) | summarize by SourceIP,DestinationIP;
CommonSecurityLog | where TimeGenerated >= ago(2d) | join kind=leftanti Base on SourceIP,DestinationIP | project TimeGenerated, SourceIP,DestinationIP,DestinationPort,DeviceActionPotential shell execution on appliance host where endpoint telemetry exists
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("sh","bash","curl","wget","nc","python3")
| where InitiatingProcessFileName has_any ("httpd","nginx","cgi","perl")
| project TimeGenerated,DeviceName,FileName,ProcessCommandLine,InitiatingProcessFileNameAppliance restart and service anomalies in system logs
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("reboot","restart","service stopped","service started")
| project TimeGenerated,Computer,ProcessName,SyslogMessageDetection Notes
The highest-value first pass is the initial query when the required data is ingested; correlate with asset inventory before attributing activity. Generic process, network, and administrative events can reflect legitimate operations. DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents require endpoint telemetry ingested into Sentinel; Syslog requires forwarding; CommonSecurityLog requires suitable network or HTTP fields. A missing table or absent process command line is a visibility gap, not a negative result. No query can establish patch level without separate inventory. These queries do not identify a vendor-confirmed exploit signature; HTTP fields and ports vary by deployment.
