Summary
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606
- Vendor
- Barracuda Networks
- Product
- Multiple Products
- Added to KEV
- Nov 10, 2026
- Remediation due
- Nov 13, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-78
- EPSS
- 1.1% as of Nov 10
In the news · last mention Nov 9
References