CVE-2026-111560: OS Command Injection in Barracuda Appliances

Analysis on rafaelpfister.ch

Article · November 11, 2026 CVE-2026-116606: Barracuda ESG Authentication Bypass Is Being Exploited - Update and Check for Compromise An authentication bypass in Barracuda Email Security Gateway before 9.4.0.030 (CVE-2026-116606, CVSS 4.0: 9.3) allows a crafted configuration backup to be imported without logging in. Barracuda confirms attacks, and CISA has listed the vulnerability in its KEV Catalog since November 10, 2026. Patches have been available since November 2; the management interface should not be accessible from the internet.

Vendor description

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

Reference data

Vendor

Barracuda Networks

Affected products

Barracuda Email Security Gateway (ESG)
Barracuda Load Balancer Application Delivery Controller (ADC)
Barracuda Web Application Firewall (WAF)
Barracuda Web Security Gateway (WSG)
Barracuda Message Archiver (BMA)
Barracuda WAF Control Center (WCC)

CVSS 4.0

8.6 (HIGH)

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Weakness type

CWE-78: OS Command Injection

Published

November 2, 2026

In KEV catalog since

November 10, 2026

US federal deadline

November 13, 2026

Official sources

← All vulnerabilities