{"dataType":"CVE_RECORD","dataVersion":"5.0","cveMetadata":{"cveId":"GCVE-110-NCSC-2026-465","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-11-04T09:41:25Z","dateUpdated":"","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"nl","value":"An authentication bypass vulnerability in Barracuda Email Security Gateway versions prior to 9.4.0.030 allows unauthenticated remote attackers to restore crafted backup archives and alter global configurations without authorization.","supportingMedia":null},{"lang":"nl","value":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","supportingMedia":null},{"lang":"nl","value":"An authenticated administrator can exploit improper neutralization of shell metacharacters in the timezone configuration of certain Barracuda appliances to execute OS commands with root privileges.","supportingMedia":null},{"lang":"nl","value":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","supportingMedia":null}],"references":[{"url":"https://advisories.ncsc.nl/csaf/v2/2026/ncsc-2026-0465.json","name":"","tags":["advisory"]},{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-116606.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-111560.json","name":"","tags":["advisory"]}],"metrics":null,"problemTypes":[{"descriptions":[{"lang":"en","description":"Authentication Bypass Using an Alternate Path or Channel","cweId":"CWE-288","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Neutralization of Special Elements used in an OS Command","cweId":"CWE-78","type":"CWE"}]}],"affected":[{"vendor":"Barracuda","product":"vers:unknown/*","collectionURL":"","packageName":"","repo":"","defaultStatus":"","versions":null,"cpes":null,"modules":null,"programFiles":null,"platforms":null},{"vendor":"Barracuda Networks","product":"vers:unknown/*","collectionURL":"","packageName":"","repo":"","defaultStatus":"","versions":null,"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null,"x_vulnetix_aliases":{"direct":["CVE-2026-111560","CVE-2026-116606"]}},"adp":null}}