CVE-2026-111560: Timezone configuration field (shared appliance code)
OS command injection in the timezone configuration field shared across Barracuda appliances. An administrator can inject shell metacharacters that execute as root. On ESG it chains with CVE-2026-116606 for a path from the admin interface to root. No exploitation reported as of Nov 3, 2026.
Executive Summary & Technical Impact
OS command injection in the timezone configuration field shared across Barracuda appliances. An administrator can inject shell metacharacters that execute as root. On ESG it chains with CVE-2026-116606 for a path from the admin interface to root. No exploitation reported as of Nov 3, 2026.
Tracked under CVE-2026-111560 (CWE-78 (OS Command Injection)), this vulnerability affects ESG ≤ 9.4.0.27 (and all ESG per Barracuda), ADC ≤ 6.4.0, WAF ≤ 11.0.1, WSG ≤ 16.1.100.100, Message Archiver ≤ 5.5.4.0, WAF Control Center ≤ 2.2.1 and carries a severity score of 8.6 (CVSS 4.0, Mandiant CNA) (HIGH). Engineering and security operations teams running ESG, Load Balancer ADC, WAF, WAF Control Center, Message Archiver, Web Security Gateway should prioritize upgrading to ESG BNSF-40425/40430 + 9.4.0.029+; ADC/WAF BNADC-16586; BMA BNMA-32468; WCC BNWF-60060; WSG BNYF-24789.
Remediation & Patch Guidance
- Apply the product-specific patch listed in Barracuda Campus for each affected appliance.
- Restrict administrative interfaces to trusted networks and rotate shared admin credentials.
- On ESG, treat this as part of the CVE-2026-116606 chain and verify firmware 9.4.0.029+.
Frequently Asked Questions (CVE-2026-111560)
What versions are affected by CVE-2026-111560?
CVE-2026-111560 affects ESG ≤ 9.4.0.27 (and all ESG per Barracuda), ADC ≤ 6.4.0, WAF ≤ 11.0.1, WSG ≤ 16.1.100.100, Message Archiver ≤ 5.5.4.0, WAF Control Center ≤ 2.2.1 in ESG, Load Balancer ADC, WAF, WAF Control Center, Message Archiver, Web Security Gateway (Timezone configuration field (shared appliance code)).
How do I patch or remediate CVE-2026-111560?
Upgrade affected deployments to ESG BNSF-40425/40430 + 9.4.0.029+; ADC/WAF BNADC-16586; BMA BNMA-32468; WCC BNWF-60060; WSG BNYF-24789 and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-111560?
CVE-2026-111560 is rated HIGH with a CVSS score of 8.6 (CVSS 4.0, Mandiant CNA) (vector: Network; high privileges (admin) required; commands execute as root across six Barracuda products).
Barracuda ESG: A Pre-Auth Config Import Plus a Timezone Field Equals Root (CVE-2026-116606, CVE-2026-111560)
Barracuda has patched an authorization bypass in Email Security Gateway and a root command injection shared by six of its appliances. No exploitation is reported yet, but ESG has been an espionage target before.
Read full engineering post-mortem (5 min read) →