OS Command Injection in Barracuda Appliances
Historical advisory recorded 2 Nov 2026 20:57:17 UTC. Read the latest advisory.
cve-program · CVE-2026-111560
PublishedImproper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-111560
PublishedOS Command Injection in Barracuda Appliances
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
- Source published
- 2 Nov 2026 12:59:03 UTC
- Source modified
- 2 Nov 2026 19:43:04 UTC
- Saved here
- 2 Nov 2026 20:57:17 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 4.0 · 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N