CVE-2026-111560

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

CVSS

8.6

EPSS

0.005 (40.8th percentile)

CISA KEV

Not listed

Exploitation

none

Public exploits

None seen

State

PUBLISHED

Coverage

• 

  watchTowr Labs◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards2 hours ago

  Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)

  Yes, that's right! Today we're at the aquarium. Welcome back to yet another watchTowr Labs blog post. You can begin preparing your comments now. What Is A Barracuda, And Why? Must We? Barracuda’s Email Security Gateway solution (ESG) is no stranger to love, for

  ↗labs.watchtowr.com/barracuda-networks-is-your-n…(opens the publisher's site in a new tab)

What we observed