Vulnerability in Barracuda Networks Barracuda Email Security Gateway (ESG)

[ Description ]Official description

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL4 Nov 2026NCSC-2026-0465

  Vulnerabilities fixed in Barracuda Email Security Gateway Translated from Dutch

  Probability/damage M/HCVE-2026-116606CVE-2026-111560
• BSI CERT-Bund2 Nov 2026WID-SEC-2026-4295

  Barracuda Networks Email Security Gateway and Web Application Firewall: Multiple vulnerabilities Translated from German

  CVE-2026-116606CVE-2026-111560

[ References ]References

• github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md
• trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection