CVE-2026-111560

Vendor

Barracuda

Product

Barracuda Email Security Gateway (ESG), Barracuda Load Balancer Application Delivery Controller (ADC), Barracuda Web Application Firewall (WAF), Barracuda Web Security Gateway (WSG)

CVSS v4.0

8.6 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness

CWE-78

Exposure class

Email, Edge / VPN / firewall

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 37
   CVE NVD 3h ago

   Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda…

   Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with…

   CVSS 8.6 CVE-2026-111560 Barracuda