Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

CISA lists Barracuda OS command injection in KEV (CVE-2026-111560)

Original title: CISA KEV: Barracuda Networks Multiple Products OS Command Injection Vulnerability — Barracuda Networks Multiple Products (CVE-2026-111560)

CISA Known Exploited Vulnerabilities ()1 min read1
Read at cisa.gov
Part of a story covered by 9 sourcesBarracuda ESG flaws chained for root; CISA lists both as exploitedMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

An authenticated administrator can run root commands through a crafted timezone value; the federal due date is November 13.

CISA added CVE-2026-111560, an OS command injection flaw affecting several Barracuda Networks products, to its Known Exploited Vulnerabilities catalog. An authenticated administrator can inject commands that run as root when a crafted timezone value is processed. CISA says the flaw can be chained with CVE-2026-116606. The due date is November 13, and known ransomware use is unknown.

Unconfirmed: Known ransomware campaign use is listed as unknown.

Key facts
  • Named products include ESG, Load Balancer, ADC, BMA, WCC, WAF, and WSG.
  • Commands execute with root privileges after timezone processing.
  • CISA requires vendor mitigations, BOD 26-04 compliance, and forensics triage.
  • No fixed version is stated.
Security assessment · AI, from the articleExploited in the wild

Impact: authenticated administrator command execution as root

ProductAffected
Barracuda Networks Email Security Gateway (ESG)—
Barracuda Networks Load Balancer—
Barracuda Networks Application Delivery Controller (ADC)—
Barracuda Networks Message Archiver (BMA)—
Barracuda Networks WAF Control Center (WCC)—
Barracuda Networks Web Application Firewall (WAF)—
Barracuda Networks Web Security Gateway (WSG)—
What to do
  1. 1.Apply vendor mitigations and follow BOD 26-04 and forensics triage guidance.
  2. 2.Discontinue use if mitigations are unavailable.
  3. 3.Complete required action by November 13.
Analyze CVE-2026-111560 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-111560
ATT&CK
T1059 Command and Scripting Interpreter
Tags
cisa-kevbarracudacommand-injectionemail-securitybod-26-04
Vendors
Barracuda Networks
Products
Email Security GatewayLoad BalancerApplication Delivery ControllerMessage ArchiverWAF Control CenterWeb Application FirewallWeb Security Gateway
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111560
Command Injection in Barracuda Appliance Timezone Field
8.61%KEV
KEV

From the original article

1 min read at cisa.gov

Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability.

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.