CVE-2026-111560
OS Command Injection in Barracuda Appliances
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
| CWE | CWE-78 |
| Vendor | barracuda networks |
| Product | barracuda email security gateway (esg) |
| Published | Nov 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for barracuda networks barracuda email security gateway (esg)
Be the first to know when new unknown vulnerabilities affecting barracuda networks barracuda email security gateway (esg) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Barracuda Networks / Barracuda Email Security Gateway (ESG)
0 ≤ 9.4.0.27
Barracuda Networks / Barracuda Load Balancer Application Delivery Controller (ADC)
0 ≤ 6.4.0
Barracuda Networks / Barracuda Web Application Firewall (WAF)
0 ≤ 11.0.1
Barracuda Networks / Barracuda Web Security Gateway (WSG)
0 ≤ 16.1.100.100
Barracuda Networks / Barracuda Message Archiver (BMA)
0 ≤ 5.5.4.0
Barracuda Networks / Barracuda WAF Control Center (WCC)
0 ≤ 2.2.1