CVE-2026-111560

— UNSCOREDpublic exploit available

Published 2026-11-02 · Updated 2026-11-03

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

Weaknesses

CWE-78

Public exploit & PoC references

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md

All references

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md
https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2013-20007PoC
HIGHCVE-2020-37279PoC
CRITICALCVE-2020-37282PoC
HIGHCVE-2022-51019PoC
CRITICALCVE-2024-4457PoC
HIGHCVE-2025-14754
CRITICALCVE-2025-31704
CRITICALCVE-2025-71429PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.