CVE-2026-111560
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- Published by NVD
- Last updated by NVD
- First covered by RedTeamDaily
Coverage
Barracuda patches two flaws that could let attackers gain root access on appliances
Barracuda has disclosed CVE-2026-116606, a pre-authentication authorisation bypass in Barracuda Email Security Gateway rated 9.3 CVSS, and CVE-2026-111560, a command injection flaw rated 8.6 across six product families. Combined, the vendor says they could bypass controls and obtain root access, though exploitation requires access to the administrative interface. The advisory reports no active exploitation, and Barracuda labels both issues High; administrators should restrict management interfaces to trusted networks and apply the firmware patches.
Sources: NVD and CISA known exploited vulnerabilities catalogue.