---
id: "CVE-2026-111560"
kind: "vulnerability"
aliases: ["CVE-2026-111560"]
title: "Barracuda appliances: timezone field lets an admin run root OS commands"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["barracuda", "infrastructure", "network-appliance"]
not_affected_if: ["auth-required", "no-barracuda-appliance"]
published_at: "2026-11-02T13:17:35+00:00"
first_seen_at: "2026-11-02T13:23:16+00:00"
updated_at: "2026-11-02T13:25:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111560", "first_seen_at": "2026-11-02T13:23:16+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T13:25:38+00:00"}]
---

# Barracuda appliances: timezone field lets an admin run root OS commands

Certain Barracuda appliances fail to sanitize shell metacharacters in the timezone configuration field. An authenticated administrator can inject operating system commands that run with root privileges when the value is processed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

unknown: the affected Barracuda models and firmware versions are not published in any source found

## Timeline

- 2026-11-02T13:23:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111560
- 2026-11-02T13:25:38+00:00 analyst — No primary source found. NVD/cve.org pages return no description (cve.org shows CNA: Mandiant). Barracuda CGF CVE overview (documentation.campus.barracuda.com NGFEOL 5505175) and trust.barracuda.com PHP page do not list this CVE. Models, versions, fix unknown; would be settled by Mandiant's advisory or a Barracuda security advisory naming the product. Nothing verified.

## From the sources

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_