Barracuda timezone field RCE exploited in the wild (CVE-2026-111560)

Actively exploited in the wild - CVE-2026-111560 is a high-severity OS command injection in Barracuda appliance products that share common Barracuda code, where an authenticated administrator can slip shell metacharacters into the timezone configuration field and gain root-level command execution. CISA has added it to the Known Exploited Vulnerabilities catalog; treat every exposed management interface as a live target.

Overview

CVE-2026-111560 stems from improper neutralization of shell metacharacters in the timezone configuration field. The affected firmware passes that value to an operating system shell when applying time settings, and it does so without sanitizing input. Because the field is reachable by any account with administrative rights, an attacker who already holds admin credentials, or who has stolen a session, can chain a weak privilege boundary into full root on the appliance.

The CVSS score is 8.6 and the vector is network, low complexity, high privileges required, no user interaction. The high-privileges requirement lowers the score but does not lower the risk: Barracuda appliances sit at the network edge as mail, web, and firewall gateways, so an admin-level compromise there is a pivot into everything behind it.

Impact

Successful exploitation lets an attacker run arbitrary commands as root on the appliance. That means they can read and alter configuration, exfiltrate mail or traffic data passing through the device, install persistence, and move laterally into internal networks the appliance is trusted to protect. Because the malicious command fires when the crafted timezone value is later processed, a scheduled reboot or config reload can be enough to trigger it, which also makes detection harder. Organizations that log admin logins but not configuration changes may miss the initial write entirely.

Remediation and Mitigation

• Apply the vendor’s fixed firmware as soon as it is available and confirm the build number on each appliance; appliances sharing the common Barracuda code base should all be checked.
• Rotate credentials and invalidate sessions for every administrative account that could reach the timezone field, then review audit logs for unexpected timezone changes or shell characters in configuration values.
• Restrict management access to a dedicated admin network and enforce multi-factor authentication so a stolen password alone is not enough.
• If patching is delayed, disable or tightly restrict the timezone and general settings interfaces to trusted administrators and monitor for reboots or config reloads following any settings change.

Security Insight

The defining detail here is that the bug converts a configuration convenience into a root execution primitive on a device that terminates trust at the network edge, and exploitation in the wild confirms attackers value that position. It echoes previous appliance command-injection incidents, where admin-panel fields were repeatedly the weak link, and it suggests Barracuda’s shared code base carries input-sanitization debt across product lines rather than in one isolated build. Evidence on how edge appliances are being abused in campaigns is collected in our security news, with victim disclosures tracked in breach reports.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs