---
title: Hunt: Barracuda ESG exploitation looks like a failed admin password change plus a backup upload to /cgi-mod/index.cgi | ctxsec
url: https://ctxsec.com/items/hunt-barracuda-esg-cgi-mod-bayesian-upload-backup-restore-timezone-injection
description: "The public chain is a single unauthenticated multipart POST to /cgi-mod/index.cgi carrying user=admin, mismatched new_password/retype_password values, pu_bayesian_upload=1 and a file in the bayesian field. The file is a crafted configuration backup whose Spam_Config MySQL dump sets system_timezone to a value with shell metacharacters, which runs as root during the restore."
status: "detection guidance built from watchTowr's published exploit chain (Nov 5, 2026) and Barracuda's advisory; Barracuda has not published IOCs from the exploitation it observed"
published: 2026-11-10
---

> The public chain is a single unauthenticated multipart POST to /cgi-mod/index.cgi carrying user=admin, mismatched new_password/retype_password values, pu_bayesian_upload=1 and a file in the bayesian field. The file is a crafted configuration backup whose Spam_Config MySQL dump sets system_timezone to a value with shell metacharacters, which runs as root during the restore.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-barracuda-esg-cgi-mod-bayesian-upload-backup-restore-timezone-injection.md)

detection guidance built from watchTowr's published exploit chain (Nov 5, 2026) and Barracuda's advisory; Barracuda has not published IOCs from the exploitation it observed

2026-11-10

### Hunt: Barracuda ESG exploitation looks like a failed admin password change plus a backup upload to /cgi-mod/index.cgi

- **Web/proxy logs in front of the Admin UI:** POSTs to `/cgi-mod/index.cgi` from addresses outside your admin ranges, especially multipart bodies containing `new_password`, `retype_password`, `pu_bayesian_upload` or `bayesian`, and responses carrying "Error: Password Change".
- **Appliance audit log:** `failed_password_change` entries for admin that nobody made, followed by a configuration restore you didn't run.
- **Configuration:** a `system_timezone` value that isn't a plain zone name (look for `'`, `;`, `#` or backticks), and unexpected changes to admin accounts, relays, forwarding or allowed hosts, since a restore rewrites the global config.
- **Response:** if you find hits, Barracuda Support should be your first call. Given the 2023 ESG zero-day history, don't assume a firmware update removes an implant; collect evidence before re-imaging.

Sources: [watchTowr Labs technical analysis (Nov 5, 2026)](https://labs.watchtowr.com/barracuda-networks-is-your-new-best-friend-barracuda-email-security-gateway-pre-auth-remote-root-rce-cve-2026-116606-cve-2026-111560/) · [watchTowr detection artifact generator (GitHub)](https://github.com/watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560) · [Barracuda Trust Center advisory (updated Nov 9, 2026)](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection)