CVE-2026-111560
Barracuda Networks Multiple Products OS Command Injection Vulnerability
What is it?
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
Official description from NVD.
What happened
CISA added CVE-2026-111560, an OS command injection flaw affecting Barracuda ESG, Load Balancer, ADC, BMA, WCC, WAF, and WSG, to the KEV catalog. Authenticated administrators can inject OS commands executing with root privileges via crafted timezone values. Combined with CVE-2026-116606, it enables unauthenticated root compromise. Federal patch deadline is November 13, 2026.
From the Intel60 brief of Nov 10, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalCISA adds Barracuda OS command injection to KEVNov 10, 2026