Live › vulnerability › CVE-2026-111560
Certain Barracuda appliances fail to sanitize shell metacharacters in the timezone configuration field. An authenticated administrator can inject operating system commands that run with root privileges when the value is processed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 13:23 UTC. All times on this page are UTC.
Organizations running affected Barracuda appliances, where administrators can change the timezone setting. The sources do not list the affected product models or versions. Attackers need administrator credentials, so teams that restrict admin access have lower exposure, but the sources do not say which models are affected.
No product ranges from the sources yet.
unknown: the affected Barracuda models and firmware versions are not published in any source found
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
This page as .md · .json · in your agent: get_signal("CVE-2026-111560")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.