CVE-2026-111560
High8.6Barracuda Email Security Gateway (ESG): OS Command Injection in Barracuda Appliancestitle from the CVE record
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
- CVSS
- 8.6v4.0
- EPSS (exploit probability)
- Unavailable
- CISA KEV
- Not listed
EPSS trendFIRST daily scores, last 90 days
Unavailable
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Learn
Why it happened and what stops it
How attackers use it (ATT&CK)
Typical for this kind of weakness across CISA KEV exploits (CTID), not specific to this CVE.
How it's exploited
What the attacker gets
Controls that mitigate it (NIST SP 800-53)
- AC-3Access EnforcementAccess Control · mitigates 8 of these techniques
- AC-6Least PrivilegeAccess Control · mitigates 7 of these techniques
- SI-4System MonitoringSystem and Information Integrity · mitigates 7 of these techniques
- AC-2Account ManagementAccess Control · mitigates 6 of these techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 6 of these techniques
- CA-7Continuous MonitoringSecurity Assessment and Authorization · mitigates 5 of these techniques
Coverage1 article
SANS Stormcast Tuesday, November 3rd, 2026: Multipath TCP (MPTCP) Detection; BTCPay Server 2.4.1 Hot Wallet Thefts; Barracuda ESG Flaws (CVE-2026-116606, CVE-2026-111560); Synology DSM Ransomware
Podcast6 minSANS Internet Storm Center StormCast3h agoVulnerabilitiesEndpointNetworkCVE-2026-111560CVE-2026-116606+1