CVE-2026-111560
Improper neutralization of shell metacharacters in the timezone configuration field in certain…
- Risk score
- 52/100
- CVSS
- 8.6 v4.0
- Published
- 2 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.6 high
References
Original description
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
Last activity 2 Nov 2026. Patch Forecast updates every hour.