Barracuda Appliance Timezone Field Command Injection (CVE-2026-111560)

Mandiant's CVE description says shell metacharacters in the timezone configuration field are not neutralized across several appliance products that share common Barracuda code. An authenticated administrator who sets a crafted timezone value can inject OS commands that run with root privileges once the appliance processes that value.

Mandiant, the CNA that assigned the CVE, scores CVE-2026-111560 8.6 in CVSS 4.0, in disclosure MNDT-2026-0041. The vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Barracuda's own advisory lists the same 8.6 score and calls it High severity. No CVSS 3.1 score appears in the record or on NVD, where the CVSS panel still reads "N/A, NVD assessment not yet provided" as of 2 November 2026.

Six Products Share the Flaw

Barracuda's advisory lists CVE-2026-111560 against Email Security Gateway, Load Balancer ADC, Web Application Firewall, Web Security Gateway, Message Archiver and WAF Control Center. They share the same timezone-handling code. Email Security Gateway is also affected by an unauthenticated configuration-import authentication bypass tracked as CVE-2026-116606.

Barracuda's advisory says the two flaws, used in combination, could let an attacker bypass authorization controls and obtain root access to the device. The authentication bypass can supply the administrator session that this command injection then needs.

What the Record Does Not Say About Setting the Timezone

The record does not state the exact administrative interface field or workflow an administrator uses to set the timezone value. It also does not say whether a proof-of-concept exploit has been published.

What CISA KEV, Barracuda and Mandiant Say About Exploitation

These are the public signals we checked on 2 November 2026. Each one is listed below with what it currently shows.

Barracuda appliances running shared code are not the only network products hit by command injection through an administrative field this year. Arista's own VeloCloud Orchestrator carried an OS command injection, CVE-2026-16812, in a different configuration path. Both show the same underlying failure, a configuration value reaching a shell without being sanitized first.

Barracuda's advisory lists six affected products for CVE-2026-111560. Each has its own fixed version and patch identifier.

ADC and WAF share patch BNADC-16586. Barracuda recommends confirming each device shows the latest firmware version and, if automatic patching is off, applying the matching patch manually. Our vulnerability management guide covers planning an update across several products on different release trains, which applies directly here with six separate fixed versions to track.