CVE-2026-111560 OS Command Injection in Barracuda Appliances

Produsentens beskrivelse (engelsk)

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

Referansedata

Produsent

Barracuda Networks

Berørte produkter

• Barracuda Email Security Gateway (ESG)
• Barracuda Load Balancer Application Delivery Controller (ADC)
• Barracuda Web Application Firewall (WAF)
• Barracuda Web Security Gateway (WSG)
• Barracuda Message Archiver (BMA)
• Barracuda WAF Control Center (WCC)

CVSS 4.0

8.6 (HIGH)

Vektor

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Type svakhet

CWE-78: OS Command Injection

Publisert

2. november 2026

I KEV-katalogen siden

10. november 2026

Frist amerikanske føderale etater

13. november 2026

Offisielle kilder

• CVE.org
• NVD
• CISA KEV
• Produsentens advisory

← Alle sårbarheter