Vulnerability details
CVE-2026-111560
Actively exploited
Barracuda Networks Barracuda Email Security GatewayBarracuda Networks Barracuda Load Balancer Application Delivery ControllerBarracuda Networks Barracuda Message ArchiverBarracuda Networks Barracuda WAF Control CenterBarracuda Networks Barracuda Web Application FirewallBarracuda Networks Barracuda Web Security Gateway
OS Command Injection in Barracuda Appliances
CVSS 4.0
8.6High
Official description
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
Related news
-
Security Affairs newsletter Round 603 by Pierluigi Paganini – INTERNATIONAL EDITION
Security Affairs · 2 d ago
-
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
The Hacker News · 4 d ago
-
Two Barracuda ESG Flaws Could Be Combined for Full Root Access; Patches Released
Security Affairs · 6 d ago
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.6High | 4.0 | CVEProject cvelistV5 (CNA) (Mandiant) | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Barracuda Networks | Barracuda Email Security Gateway (ESG) | v ≤ 9.4.0.27 | CVEProject cvelistV5 (CNA) |
| Barracuda Networks | Barracuda Load Balancer Application Delivery Controller (ADC) | v ≤ 6.4.0 | CVEProject cvelistV5 (CNA) |
| Barracuda Networks | Barracuda Message Archiver (BMA) | v ≤ 5.5.4.0 | CVEProject cvelistV5 (CNA) |
| Barracuda Networks | Barracuda WAF Control Center (WCC) | v ≤ 2.2.1 | CVEProject cvelistV5 (CNA) |
| Barracuda Networks | Barracuda Web Application Firewall (WAF) | v ≤ 11.0.1 | CVEProject cvelistV5 (CNA) |
| Barracuda Networks | Barracuda Web Security Gateway (WSG) | v ≤ 16.1.100.100 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md third-party-advisory
- https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111560 government-resource
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-02
- Last updated
- 2026-11-10
- State
- Published
- Assigner (CNA)
- Mandiant
- Kolun priority
- 69 · High
CISA KEV catalog
- Date added
- 2026-11-10
- Due date
- 2026-11-13
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
1.06%
Probability of exploitation in 30 days
64.7%
Percentile (among all CVEs)
- 2026-11-091.06%
- 2026-11-030.47%
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78Improper neutralization of special elements used in an OS command ('OS command injection')