CVE-2026-111560: OS Command Injection

Published Nov 2, 2026

Updated

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

Event History

Nov 2, 2026

CVE Published

via NVD·01:17 PM

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Nov 3, 2026

News Published

via BleepingComputer·03:06 PM

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

An attacker must already be authenticated as an administrator. The vulnerable timezone configuration field can then be supplied with crafted shell metacharacters.

What is the impact of successful exploitation?

Injected OS commands execute with root privileges when the crafted timezone value is subsequently processed. This can compromise the confidentiality, integrity, and availability of the affected appliance.

Is user interaction required for exploitation?

No user interaction is required. Exploitation depends on an authenticated administrator setting a crafted timezone value and the appliance subsequently processing that value.

CVE-2026-111560: OS Command Injection

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the impact of successful exploitation?

Is user interaction required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the impact of successful exploitation?

Is user interaction required for exploitation?