Barracuda security appliances hit by two critical vulnerabilities
Patches released for CVE-2026-116606 authorization bypass and CVE-2026-111560 command injection in Barracuda Email Security Gateway and other products.
75
Vulnerability1 · 1 read
CVE-2026-111560
Command Injection in Barracuda Appliance Timezone Field
- CVSS 4.0
- 8.6 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An authenticated administrator on certain Barracuda appliance products can inject OS commands by crafting values with shell metacharacters in the timezone configuration field. When the value is processed, commands execute with root privileges. Admins on affected appliances are impacted.
What to do: Apply Barracuda's update for CVE-2026-111560. No workaround provided.
| Product | Affected |
|---|---|
| Barracuda appliance products | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
- Weakness
- CWE-78
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
4 storiesBarracuda Email Security Gateway flaws expose devices to root compromise
CVE-2026-116606 and CVE-2026-111560 could enable root access on ESG appliances.
70
Barracuda flaws chained to bypass authorization and gain root access
Chaining the two vulnerabilities allows root access if the admin interface is accessible; restrict admin exposure to internal networks and update firmware.
65
Barracuda critical flaws allow root access to devices
Two critical vulnerabilities in Barracuda ESG and related products could enable root access; patches released for affected versions.
60