Command Injection in Barracuda Appliance Products
CVE-2026-111560

8.6HIGH

Key Information:

Vendor: Barracuda Networks
Status: Barracuda Email Security Gateway (esg); Barracuda Load Balancer Application Delivery Controller (adc); Barracuda Web Application Firewall (waf); Barracuda Web Security Gateway (wsg)
Vendor: CVE Published:; 2 November 2026

🔔 Create Barracuda Networks Vulnerability Alert

What is CVE-2026-111560?

An improper handling of shell metacharacters in the timezone configuration field of specific Barracuda appliance products allows authenticated administrators to inject malicious OS commands. This vulnerability occurs when crafted timezone values are processed, potentially leading to execution of these commands with root privileges. The risk associated with this vulnerability underlines the importance of secure coding practices and rigorous input validation.

Affected Version(s)

Barracuda Email Security Gateway (ESG) 0 <= 9.4.0.27

Barracuda Load Balancer Application Delivery Controller (ADC) 0 <= 6.4.0

Barracuda Message Archiver (BMA) 0 <= 5.5.4.0

References

https://github.com/mandiant/Vulnerability-Disclosures/blo...

third-party-advisory

https://trust.barracuda.com/security/pre-authentication-a...

vendor-advisory

CVSS V4

Score:

8.6

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 2, 2026
Vulnerability Reserved
Oct 16, 2026

CVE-2026-111560 Data

JSON