WhatCyber / CISA KEV catalog / CVE-2026-111560

CVE-2026-111560: Barracuda Networks Multiple Products

Barracuda Networks Multiple Products OS Command Injection Vulnerability

Actively exploited (CISA KEV) HIGH severity

Description

Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606

Key facts

CVSS v3: 7.2 (HIGH)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: 2026-11-02
Last modified: 2026-11-12
NVD status: Analyzed
Added to CISA KEV: 2026-11-10
CISA due date: 2026-11-13

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection ; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-111560

Weaknesses (CWE)

CWE-78

Affected products

barracuda email_security_gateway_300_firmware
barracuda email_security_gateway_300
barracuda email_security_gateway_400_firmware
barracuda email_security_gateway_400
barracuda email_security_gateway_600_firmware
barracuda email_security_gateway_600
barracuda email_security_gateway_800_firmware
barracuda email_security_gateway_800
barracuda email_security_gateway_900_firmware
barracuda email_security_gateway_900
barracuda web_application_firewall
barracuda web_security_gateway_firmware
barracuda web_security_gateway_310vx
barracuda web_security_gateway_410vx
barracuda web_security_gateway_610vx
barracuda web_security_gateway_1010
barracuda web_security_gateway_1011
barracuda web_security_gateway_210
barracuda web_security_gateway_310
barracuda web_security_gateway_410
and 34 more