CVE-2026-111560highCWE-78

CVE-2026-111560: high-severity vulnerability in Barracuda Email Security Gateway (ESG)

OS Command Injection in Barracuda Appliances

Published · Updated

Follow this CVE+ Monitor Barracuda Email Security Gateway+ Monitor Barracuda Message Archiver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.5%
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Barracuda Networks · Barracuda Email Security Gateway (ESG)Barracuda Networks · Barracuda Load Balancer Application Delivery Controller (ADC)Barracuda Networks · Barracuda Message Archiver (BMA)Barracuda Networks · Barracuda WAF Control Center (WCC)Barracuda Networks · Barracuda Web Application Firewall (WAF)Barracuda Networks · Barracuda Web Security Gateway (WSG)
Related CVEs — Barracuda Email Security Gateway (ESG)

In the same product, most dangerous first.

CVE-2026-116606CRITICALAuthentication Bypass Allows Global Configuration Restore in Barracuda Email Security GatewayEPSS 0.7%