Y2Y2
Open Cyber
Public vulnerability disclosure

CVE-2026-111560

OS Command Injection in Barracuda Appliances

publishedCWE-78

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

Investigate in Cyber JSONMarkdown
Technical severity8.6 highCVSS 4.0 · CNA: Mandiant
Published2026-11-02Source updated 2026-11-02
Collected2026-11-021 attributed source

Fixes and workarounds

No remediation reported in collected sources.

Missing remediation information is not evidence that no patch exists.

Affected products and versions

ProductVersionsAuthority
Barracuda Email Security Gateway (ESG)
Barracuda Networks 		≥ 0; ≤ 9.4.0.27 (affected, custom)
Other versions: unaffected 		CNA: Mandiant
Barracuda Load Balancer Application Delivery Controller (ADC)
Barracuda Networks 		≥ 0; ≤ 6.4.0 (affected, custom)
Other versions: unaffected 		CNA: Mandiant
Barracuda Web Application Firewall (WAF)
Barracuda Networks 		≥ 0; ≤ 11.0.1 (affected, custom)
Other versions: unaffected 		CNA: Mandiant
Barracuda Web Security Gateway (WSG)
Barracuda Networks 		≥ 0; ≤ 16.1.100.100 (affected, custom)
Other versions: unaffected 		CNA: Mandiant
Barracuda Message Archiver (BMA)
Barracuda Networks 		≥ 0; ≤ 5.5.4.0 (affected, custom)
Other versions: unaffected 		CNA: Mandiant
Barracuda WAF Control Center (WCC)
Barracuda Networks 		≥ 0; ≤ 2.2.1 (affected, custom)
Other versions: unaffected 		CNA: Mandiant

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
4.0 / 8.6
high		 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCNA: Mandiant

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References