CVE-2026-111560 is a high-severity vulnerability. Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted time zone value is subsequently processed.

This vulnerability affects the following Barracuda Networks products:

Barracuda Email Security Gateway (ESG) versions ≤ 9.4.0.27
Barracuda Load Balancer Application Delivery Controller (ADC) versions ≤ 6.4.0
Barracuda Web Application Firewall (WAF) versions ≤ 11.0.1
Barracuda Web Security Gateway (WSG) versions ≤ 16.1.100.100
Barracuda Message Archiver (BMA) versions ≤ 5.5.4.0
Barracuda WAF Control Center (WCC) versions ≤ 2.2.1

This vulnerability allows an authenticated administrator to inject operating system commands through the time zone configuration field. When the crafted time zone value is processed, the commands are executed with root privileges, potentially giving the attacker full control of the device.

Step 1 - Access the Administrative Interface

The attacker gains access to the administrative interface of a vulnerable Barracuda Networks appliance.

Step 2 - Modify the Timezone Configuration

The attacker enters a specially crafted timezone value containing shell metacharacters into the time zone configuration field.

Step 3 - Trigger Command Processing

The appliance processes the malicious timezone configuration due to improper input sanitization.

Step 4 - Execute Commands as Root

The injected commands execute with root privileges, allowing the attacker to run arbitrary commands and potentially take full control of the system.

CERTVU recommends the following:

1. Upgrade Immediately

   Install the latest firmware and security patches provided by Barracuda Networks. Barracuda has released patches for affected products and recommends upgrading immediately.

2. Restrict Administrative Access

   Limit access to administrative interfaces to trusted internal networks and authorized administrators only. Do not expose management interfaces directly to the internet.

3. Apply Network Access Controls

   Use firewalls, VPNs, and IP-based access restrictions to restrict management access to authorized personnel.

4. Monitor for Suspicious Activity

   Enable and monitor system logs for abnormal command execution patterns that could indicate exploitation attempts.