{"id":"CVE-2026-111560","kind":"vulnerability","aliases":["CVE-2026-111560"],"related":[],"title":"Barracuda appliances: timezone field lets an admin run root OS commands","description":"Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.","summary":"Certain Barracuda appliances fail to sanitize shell metacharacters in the timezone configuration field. An authenticated administrator can inject operating system commands that run with root privileges when the value is processed.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["barracuda","infrastructure","network-appliance"],"not_affected_if":["auth-required","no-barracuda-appliance"],"how_to_check":"unknown: the affected Barracuda models and firmware versions are not published in any source found","fix":null,"status":"open","published_at":"2026-11-02T13:17:35+00:00","first_seen_at":"2026-11-02T13:23:16+00:00","triaged_at":"2026-11-02T13:24:45+00:00","updated_at":"2026-11-02T13:25:38+00:00","category":"infrastructure","confidence":0.2,"triage":{"at":"2026-11-02T13:24:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Barracuda appliances: timezone field lets an admin run root OS commands","impact":"high","summary":"Certain Barracuda appliances fail to sanitize shell metacharacters in the timezone configuration field. An authenticated administrator can inject operating system commands that run with root privileges when the value is processed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["barracuda","network-appliance"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs commands as root on the appliance after admin login.","analyst_note":"Find the affected Barracuda product models, versions and the vendor advisory with fixed firmware (source listed only NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-111560).","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-barracuda-appliance","auth-required"],"who_is_affected":"Organizations running affected Barracuda appliances, where administrators can change the timezone setting. The sources do not list the affected product models or versions. Attackers need administrator credentials, so teams that restrict admin access have lower exposure, but the sources do not say which models are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000653,"input_tokens":4109,"output_tokens":485,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Barracuda product models, versions and the vendor advisory with fixed firmware (source listed only NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-111560).","search":"'-111560':14A,17A '-2026':13A,16A 'admin':7A 'administr':38B,76C 'allow':73C 'applianc':2A,22B,25B,67C 'authent':37B,75C 'barracuda':1A,18B,24B,66C,71C 'certain':23B,65C 'code':72C 'command':11A,43B,80C 'common':70C 'configur':34B,62C 'craft':88C 'cve':12A,15A 'execut':82C 'fail':26B 'field':4A,35B,63C 'improp':54C 'infrastructur':19B 'inject':40B,78C 'let':5A 'metacharact':30B,58C 'network':21B 'network-appli':20B 'neutral':55C 'oper':41B 'os':10A,79C 'privileg':48B,85C 'process':53B,93C 'product':68C 'root':9A,47B,84C 'run':8A,45B 'sanit':28B 'shell':29B,57C 'subsequ':92C 'system':42B 'timezon':3A,33B,61C,89C 'use':69C 'valu':51B,90C","nicknames":[],"mitigations":[],"who_affected":"Organizations running affected Barracuda appliances, where administrators can change the timezone setting. The sources do not list the affected product models or versions. Attackers need administrator credentials, so teams that restrict admin access have lower exposure, but the sources do not say which models are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["barracuda","high","infrastructure","networkappliance"],"first_public_at":"2026-11-02T13:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"mandiant-cve@google.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111560","severity":null,"published_at":"2026-11-02T13:17:35+00:00","modified_at":"2026-11-02T13:17:35+00:00","first_seen_at":"2026-11-02T13:23:16+00:00","fetched_at":"2026-11-02T13:23:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111560:1371","url":null,"severity":null,"published_at":"2026-11-02T13:25:38+00:00","modified_at":"2026-11-02T13:25:38+00:00","first_seen_at":"2026-11-02T13:25:38+00:00","fetched_at":"2026-11-02T13:25:38+00:00","note":"No primary source found. NVD/cve.org pages return no description (cve.org shows CNA: Mandiant). Barracuda CGF CVE overview (documentation.campus.barracuda.com NGFEOL 5505175) and trust.barracuda.com PHP page do not list this CVE. Models, versions, fix unknown; would be settled by Mandiant's advisory or a Barracuda security advisory naming the product. Nothing verified."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}