Barracuda Networks Multiple Products OS Command Injection Vulnerability. Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

This vulnerability can be chained with CVE-2026-116606. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.