Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
| Vendor | Product | Versions |
|---|---|---|
| barracuda | email_security_gateway_300_firmware | < 9.4.0.029 |
| barracuda | email_security_gateway_400_firmware | < 9.4.0.029 |
| barracuda | email_security_gateway_600_firmware | < 9.4.0.029 |
| barracuda | email_security_gateway_800_firmware | < 9.4.0.029 |
| barracuda | email_security_gateway_900_firmware | < 9.4.0.029 |
| barracuda | web_application_firewall | < 12.3.1.002 |
| barracuda | web_security_gateway_firmware | < 15.0.0.009 |
| barracuda | load_balancer_adc_firmware | < 6.4 |
| barracuda | message_archiver_firmware | < 5.5.4.002 |
Yes — actively exploited. Added to the CISA KEV catalog on 2026-11-10. Ransomware use: Unknown.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.