CVE-2026-111560

CVE Enrichment

CVSS: 8.6 HIGH
EPSS: 0.47%
EPSS Percentile: 40.77%
CISA KEV: Not listed

Description

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 02-Nov-2026 20:17
Last Modified: 03-Nov-2026 12:18
EPSS Date: 2026-11-03
CWE: CWE-78

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:H /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

Barracuda Networks · Barracuda Email Security Gateway (ESG) Source: CNA · [email protected]
Default status: unaffected

0 ≤ version ≤ 9.4.0.27 — affected (custom)
Barracuda Networks · Barracuda Load Balancer Application Delivery Controller (ADC) Source: CNA · [email protected]
Default status: unaffected

0 ≤ version ≤ 6.4.0 — affected (custom)
Barracuda Networks · Barracuda Message Archiver (BMA) Source: CNA · [email protected]
Default status: unaffected

0 ≤ version ≤ 5.5.4.0 — affected (custom)
Barracuda Networks · Barracuda WAF Control Center (WCC) Source: CNA · [email protected]
Default status: unaffected

0 ≤ version ≤ 2.2.1 — affected (custom)
Barracuda Networks · Barracuda Web Application Firewall (WAF) Source: CNA · [email protected]
Default status: unaffected

0 ≤ version ≤ 11.0.1 — affected (custom)
Barracuda Networks · Barracuda Web Security Gateway (WSG) Source: CNA · [email protected]
Default status: unaffected

0 ≤ version ≤ 16.1.100.100 — affected (custom)

References

Last enrichment sync: 04-Nov-2026 03:16
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) and CVE-2026-111560 (CVSS score: 8.6), respectively. Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
weakness that attackers can exploit to modify an appliance's global configuration, while the second (CVE-2026-111560) lets threat actors with admin permissions inject OS commands that run as root. Barracuda Patches Two Flaws That Could Enable Root Access to Devices

CVE (3)

Malware (2)

Threat Actors (1)

MITRE ATT&CK (2)

Vendors (1)

Products (2)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.