CVE-2026-1115608.6High
OS Command Injection in Barracuda Appliances
Barracuda Networks · Barracuda Email Security Gateway (ESG)
Not in CISA KEVVendor fix available
No EPSS score yet. The score appears once FIRST publishes it.
8.6HighCVSS
LowMediumHighCrit.
DescriptionNVD
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 2 Nov.
- Barracuda fixes flaws that could give attackers appliance root accessSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.