Barracuda ESG EUVD-2026-115148

The specific prerequisite is administrator-level access to the appliance management interface and the ability to set the timezone configuration field, into which shell metacharacters are injected and later processed with root privileges (per CVSS PR:H, authenticated). This applies across the listed Barracuda appliances that share the common Barracuda codebase (ESG, ADC/Load Balancer, WAF, WSG, BMA, WCC). The principal limiting factor is the requirement for valid administrator credentials; no user interaction is needed (UI:N) and the interface is network-reachable (AV:N). IMPORTANT CAVEAT: the referenced Barracuda advisory describes a pre-authentication authorization bypass alongside this command injection, so the authentication requirement stated here may be removable by chaining - confirm against the vendor advisory before relying on admin access as a mitigating control.

This is a credible, prioritize-this-week issue rather than a paper-high CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) scores 8.6 and is internally consistent with the description: network-reachable management interface, low attack complexity, no user interaction, full confidentiality/integrity/availability impact because injected commands run as root. The one signal that moderates raw severity is PR:H - exploitation as described requires an authenticated administrator, which normally limits the attacker population to insiders or those who have already obtained admin credentials. However, this is where the sources conflict and the risk may be understated: the Barracuda advisory URL is titled 'pre-authentication-authorization-bypass-command-injection,' implying the command injection may be chainable with an authorization bypass that removes the admin prerequisite - the CVE description (authenticated administrator) and the advisory title (pre-authentication bypass) do not agree, and this should be verified with Barracuda. The vuln.today decision label is 'this_week' (not act_now/emergency), and the finding is attributed to Mandiant. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were supplied, so there is no evidence of active or widespread exploitation yet; the priority is driven by root-level impact across multiple shipping Barracuda product lines and a credible research source, not by observed in-the-wild activity.

An attacker who holds (or has phished/brute-forced) administrator access to a Barracuda appliance's management interface enters a timezone value containing shell metacharacters; when the appliance later processes that value, the embedded commands execute with root privileges, giving full control of the device. If the separately referenced authorization-bypass weakness can be chained, a remote unauthenticated attacker could reach the same injection point. No confirmed working public exploit was provided, though both a Mandiant disclosure and a Barracuda advisory document the flaw.