OS Command Injection in Barracuda Appliances
Affects Barracuda ESG up to 9.4.0.27, Load Balancer ADC up to 6.4.0, WAF up to 11.0.1, WSG up to 16.1.100.100, BMA up to 5.5.4.0 and WCC up to 2.2.1. CVSS rates it 8.6 High; no vendor rating or fix is listed.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects certain Barracuda appliance products using common Barracuda code, via the timezone configuration field Barracuda Email Security Gateway (ESG) version 9.4.0.27 and earlier Barracuda Load Balancer ADC version 6.4.0 and earlier Barracuda Web Application Firewall (WAF) version 11.0.1 and earlier Also Barracuda Web Security Gateway (WSG) 16.1.100.100 and earlier, Message Archiver (BMA) 5.5.4.0 and earlier, and WAF Control Center (WCC) 2.2.1 and earlier
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 23/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Certain Barracuda appliance products are affected by a flaw in how the timezone configuration field handles special characters. An authenticated administrator could exploit this to run arbitrary operating system commands with root privileges on the device.
Read the original description
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
What to do
Check whether your setup matches what the bug needs.
Affects certain Barracuda appliance products using common Barracuda code, via the timezone configuration field Barracuda Email Security Gateway (ESG) version 9.4.0.27 and earlier Barracuda Load Balancer ADC version 6.4.0 and earlier Barracuda Web Application Firewall (WAF) version 11.0.1 and earlier Also Barracuda Web Security Gateway (WSG) 16.1.100.100 and earlier, Message Archiver (BMA) 5.5.4.0 and earlier, and WAF Control Center (WCC) 2.2.1 and earlierWorkaround: The checked facts list no workaround. Check the vendor advisory for mitigation guidance while no fix is available.
Timeline
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- CVE published
- First seen by cve.now1 day
- Record last updated
Affected versions
- Barracuda Networks Barracuda Email Security Gateway (ESG)
through 9.4.0.27
- Barracuda Networks Barracuda Load Balancer Application Delivery Controller (ADC)
through 6.4.0
- Barracuda Networks Barracuda Web Application Firewall (WAF)
through 11.0.1
- Barracuda Networks Barracuda Web Security Gateway (WSG)
through 16.1.100.100
- Barracuda Networks Barracuda Message Archiver (BMA)
through 5.5.4.0
- Barracuda Networks Barracuda WAF Control Center (WCC)
through 2.2.1
Evidence 2
- Advisory
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-111560
What does this mean?
The timezone configuration field does not properly neutralize shell metacharacters. An authenticated administrator can inject OS commands, which run with root privileges when the crafted timezone value is processed.Source: github.com
Am I affected, and how do I check?
Listed versions are Email Security Gateway 9.4.0.27 and earlier, Load Balancer ADC 6.4.0 and earlier, Web Application Firewall 11.0.1 and earlier, Web Security Gateway 16.1.100.100 and earlier, Message Archiver 5.5.4.0 and earlier, and WAF Control Center 2.2.1 and earlier. Compare the installed product version against these, and check the timezone configuration field.Source: github.com
What should I do about it?
The checked facts list no fixed version, so no upgrade target can be given. Check the vendor advisory for when a fix is released.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts list no workaround. Check the vendor advisory for mitigation guidance while no fix is available.Source: github.com