High-severity vulnerability in Barracuda Email Security Gateway allows OS command injection

## Overview Barracuda Networks has disclosed a high-severity vulnerability in its Barracuda Email Security Gateway (ESG). This flaw, tracked as CVE-2026-111560, affects the timezone configuration field. An authenticated administrator can exploit this vulnerability to inject operating system commands. ## Technical Details The vulnerability arises from improper neutralization of shell metacharacters in the timezone configuration field. When an administrator inputs a crafted timezone value, the system processes it without adequate sanitization. This allows the execution of OS commands with root privileges. The CVSS score for this vulnerability is 8.6, indicating a high level of risk. ## Impact Successful exploitation of this vulnerability can lead to unauthorized command execution on the affected system. This could allow attackers to gain full control over the Barracuda Email Security Gateway, potentially compromising sensitive data and system integrity. Organizations using this product should assess their exposure to this risk. ## Mitigation Defenders should prioritize updating their Barracuda Email Security Gateway to the latest version as soon as possible. Barracuda Networks is expected to release patches to address this vulnerability. In the meantime, organizations should limit administrative access to the ESG and monitor for any suspicious activities. Regular security audits and reviews of configuration settings can also help mitigate potential risks.