Security Advisory catalog CVE-2026-111560
cve-program · CVE-2026-111560 Published
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-111560 Published Barracuda Email Security Gateway (ESG) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Barracuda Networks",
"product": "Barracuda Email Security Gateway (ESG)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "9.4.0.27",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} Barracuda Load Balancer Application Delivery Controller (ADC) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Barracuda Networks",
"product": "Barracuda Load Balancer Application Delivery Controller (ADC)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "6.4.0",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} Barracuda Web Application Firewall (WAF) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Barracuda Networks",
"product": "Barracuda Web Application Firewall (WAF)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "11.0.1",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} Barracuda Web Security Gateway (WSG) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Barracuda Networks",
"product": "Barracuda Web Security Gateway (WSG)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "16.1.100.100",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} Barracuda Message Archiver (BMA) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Barracuda Networks",
"product": "Barracuda Message Archiver (BMA)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "5.5.4.0",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} Barracuda WAF Control Center (WCC) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Barracuda Networks",
"product": "Barracuda WAF Control Center (WCC)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "2.2.1",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} Original source record · Cite this exact observation · Complete original publisher JSON