Barracuda email gateways are being hacked through their admin page: patch and lock it down

Barracuda has seen attackers exploit a pair of Email Security GatewaydefinitionBarracuda's on-site box for filtering email. Mail goes through it first, and it strips out spam, phishing and malware before anything reaches your mail server. flaws that, chained together, give them root without a password. If you run an ESG, check today that the patch is installed and that nobody outside your network can reach its admin page.

An email gateway sees every message coming into the company before anyone else does. An attacker with root on it can read that mail, change how it's filtered or routed, and use the box as a foothold inside your network. If it checks recipients against your directory, it holds a login to it as well, so the damage may not stop at the appliance.

This isn't a theory any more. Barracuda updated its advisory on the evening of November 9 to say it had seen exploitation at a small number of organizations, and CISA listed both CVEs the next day. CISA also flagged them for forensic triage, so federal agencies have to look for signs of compromise as well as patch.

The one condition that matters is reach. Barracuda says the attacker needs access to the administrative interface. If your ESG's admin page answers from the internet, you're exposed to this attack path. If it only answers inside your network or over a VPN, your risk is much lower, though you still need the patch.

For engineers: Mandiant files the bypass as CWE-288, authentication bypass through an alternate path, and the injection as CWE-78, OS command injection. The injection on its own needs an admin login, which is why Barracuda first described the whole thing as needing admin access. The bypass removes that step. Barracuda corrected its advisory on November 5 to say no authentication is required, provided the attacker can reach the admin interfacedefinitionThe web page administrators use to configure an appliance. If it answers from the internet, anyone can try their luck against it..

Researchers at watchTowr published an analysis of the chain the same week. As The Hacker News summarized it, a failed password change hands back a low-privilege role instead of ending the request, which leaves the backup restore reachable. The restore checks a checksum built from a secret in the code, so an attacker can forge it. watchTowr showed the chain by writing a file as root and released a tool to check whether an appliance is vulnerable. With that much public detail, assume others can rebuild the attack.

Barracuda ships these fixes as patches to the appliance firmware, each with its own ID. ESGs set to Automatic check for patches every hour and should have them, though a reboot may still be pending. The catch is the setting. On the ESG's firmware page, patches can be applied automatically, applied by hand, or held back, and Barracuda's ESG documentation, written for firmware 9.0, lists holding them back as the default. Barracuda now tells anyone who turned automatic patching off to turn it back on.

Version numbers don't line up perfectly across sources. Canada's Cyber Centre lists the products as affected "prior to" the same numbers Mandiant lists as the last affected builds. Go by the patch ID shown on the appliance, and by Barracuda's own instruction to run the latest firmware with every security patch.

Older boxes take more work. Barracuda says a device several firmware versions behind may need more than one update before the patch applies, and asks those customers to call support. If yours hasn't been touched in a year, book the time now.

Two jobs run side by side today. Someone closes the door, by patching and blocking outside access to the admin page. Someone else checks whether anyone already came through it, because Barracuda hasn't said whether patching undoes a malicious configuration that's already been restored.

# Run it from outside, like a phone hotspot
$ curl -sI -m 10 http://esg.example.com:8000/
curl: (28) Connection timed out
# A timeout is good. Any reply at all means outsiders can reach it

Barracuda's ESG has been here before. In 2023, after the CVE-2023-2868 attacks, Barracuda told customers that compromised ESG appliances had to be replaced, whatever their patch level. The same lesson applies now: a patch closes the hole, and it does nothing about someone who already used it.

Your mail team or provider does the patching, and that's where it belongs. We pick up what sits around it. Our network security people take management consoles off the internet. Our non-human identity team finds the service accounts boxes like this keep, and rotates them. If your ESG checks recipients against Microsoft Entra ID and Active Directory, an Entra engineer can cut that bind accountdefinitionA directory login the appliance keeps so it can look people up in Active Directory or another LDAP server. The ESG uses it to check that a recipient actually exists before accepting mail. down to read-only. Not sure what else is exposed? Try the free assessment.