Loading vulnerability…
Root OS Command Injection in Barracuda Appliance Timezone Configuration
CVE-2026-111560 is an operating-system command injection vulnerability in timezone configuration handling within code shared by six Barracuda appliance product families: Email Security Gateway, Load Balancer Application Delivery Controller, Web Application Firewall, Web Security Gateway, Message Archiver, and WAF Control Center. Insufficient neutralization of shell metacharacters in the system_timezone configuration field allows an authenticated administrator to insert arbitrary OS commands. These commands execute with root privileges when the appliance subsequently processes the crafted value. On Email Security Gateway, chaining this vulnerability with the authorization bypass CVE-2026-116606 permits exploitation without authentication. The vulnerability has a CVSS v4.0 base score of 8.6 (High).
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the appliance's confidentiality, integrity, and availability through arbitrary command execution as root. An attacker can access, modify, or delete appliance data, change security configuration, and disrupt appliance services. Compromise of Email Security Gateway could additionally enable interception or disruption of enterprise email communications. Unauthenticated root compromise is possible on Email Security Gateway when combined with CVE-2026-116606; this authentication-bypass chain is not established for the other five affected product families.
If you can’t patch tonight, do this now.
Restrict appliance administrative interfaces to trusted internal networks and enforce network access controls that permit only authorized management systems. Remove public internet exposure of management interfaces, particularly when immediate patching is not possible. These restrictions reduce exposure but do not prevent exploitation by an attacker who can reach the interface and obtain the required administrative access.
Patch, then assume compromise.
Apply the appropriate Barracuda security patches and upgrade affected appliances to current fixed firmware. For Email Security Gateway, upgrade to firmware 9.4.0.030 or later, which addresses both CVE-2026-111560 and CVE-2026-116606. Barracuda also provides product-specific patches: BNSF-40425 or BNSF-40430 for Email Security Gateway, depending on the installed firmware; BNADC-16586 for Load Balancer Application Delivery Controller and Web Application Firewall; BNMA-32468 for Message Archiver; BNWF-60060 for WAF Control Center; and BNYF-24789 for Web Security Gateway. Verify patch applicability and successful installation, manually install updates not delivered automatically, and re-enable automatic patching where disabled. Substantially outdated appliances may require sequential firmware updates.
1 exploit validated by Mallory's analysis.
81 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.