CVE entry · CVE-2026-111560

CVE-2026-111560: Barracuda Networks Multiple Products OS Command Injection Vulnerability

Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606

Actively exploited: added to CISA’s KEV catalog on November 10, 2026.
Use by ransomware: not established so far.
Remediation deadline for US federal agencies: November 13, 2026.

Description from CISA’s KEV catalog.

Our analyses

Cybersecurity

Barracuda: two email gateway flaws patched November 2 are already being exploited

The November 2 patches cover six products. Since November 9, Barracuda has reported attacks against "a small number of organizations." The US agency CISA lists the flaws as exploited: here is what to check.

Nov 4, 20263 min read

What to do

Check whether your estate includes affected Barracuda Networks products, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Vendor advisory or reference cited by CISA (trust.barracuda.com)
Vendor advisory or reference cited by CISA (github.com)
NVD entry (NIST)
CISA KEV catalog

Other Barracuda Networks vulnerabilities

CVE-2026-116606Nov 10

Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

All exploited Barracuda Networks vulnerabilities