Barracuda Networks Multiple Products OS Command Injection Vulnerability
Barracuda Networks — Multiple Products
- Added to KEV catalog
- 10 November 2026
- Federal remediation due date
- 13 November 2026
- Weakness classification (CWE)
- CWE-78
AI Breakdown
What it is
Barracuda Networks products, including Email Security Gateway, Web Application Firewall, and Message Archiver, contain an operating system command injection vulnerability. An authenticated administrator can exploit this flaw by entering specially crafted values into the timezone configuration field. When the system processes the invalid timezone data, it executes arbitrary operating system commands with full root privileges.
Why it matters
This vulnerability is catalogued by CISA as actively exploited in the wild, indicating immediate real-world threat activity. Successful exploitation, especially when chained with related flaws like CVE-2026-116606, grants attackers full administrative root control over critical enterprise gateways. While known ransomware use is currently unknown, unrestricted root access on perimeter devices poses severe risks of full network compromise.
Recommended action
Apply vendor-provided mitigations and security updates immediately, prioritizing internet-exposed devices in accordance with CISA BOD 26-04 guidelines. Conduct forensic triage on all affected Barracuda appliances to ensure no malicious commands or unauthorized configuration changes have occurred. If vendor mitigations are unavailable, discontinue use of the affected appliances.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection ; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-111560
NVD Technical Description
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
More Barracuda Networks Vulnerabilities
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services