Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-111560 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | Barracuda Networks |
| Product | ESG / WAF / Load Balancer ADC / BMA / WCC / WSG |
| Vulnerability Type | OS command injection (CWE-78) |
| CVSS Score | 8.6 (high, CVSS 4.0) |
| EPSS Score | 1.1% (percentile: 65%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-11-13 |
Vulnerability Description
Barracuda Networks appliances — Email Security Gateway (ESG), Load Balancer / Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF) and Web Security Gateway (WSG) — share common code that does not neutralize shell metacharacters in the timezone configuration field. An authenticated administrator can inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
The flaw can be chained with CVE-2026-116606 — an authentication bypass in Barracuda ESG that lets an unauthenticated attacker restore a crafted configuration backup. The chain results in code execution as root without any credentials. CISA has confirmed active exploitation and set a remediation deadline of November 13, 2026 for US federal agencies. The issue was reported by Mandiant (MNDT-2026-0041).
Required Actions
- Apply the fixes and guidance from the Barracuda advisory (linked in Sources) on all listed appliances, including those managed by a partner.
- Restrict access to management interfaces to trusted addresses — the admin panel should not be reachable from the internet.
- Check appliances for signs of compromise: unexpected timezone or configuration changes, unknown administrator accounts, unusual processes and outbound connections.
- If no fix is available for a given appliance, consider taking it offline until one is released (as CISA advises).
Who Is Affected?
The vulnerability affects Barracuda Networks appliances: Email Security Gateway (ESG), Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. These devices typically sit at the network edge, which makes them an attractive target. The vendor advisory lists the affected versions.
Sources
- NVD - CVE-2026-111560
- Barracuda Trust Center - security advisory
- Mandiant MNDT-2026-0041
- CISA KEV Catalog
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-111560 vulnerability?
CVE-2026-111560 is an OS command injection flaw (CWE-78) in the timezone field of Barracuda appliances (ESG, WAF, Load Balancer ADC, BMA, WCC, WSG). It allows commands to run with root privileges. CVSS 4.0 score: 8.6; the flaw is listed in the CISA KEV catalog.
Does exploiting CVE-2026-111560 require authentication?
On its own the flaw requires administrator privileges, but chained with CVE-2026-116606 (authentication bypass in ESG) the attacker needs no credentials at all. This chain is being used in real-world attacks.
How to protect against CVE-2026-111560?
Apply the fixes from the Barracuda advisory, remove internet access to management interfaces and check appliances for signs of compromise. The CISA remediation deadline is November 13, 2026.
Who is affected by CVE-2026-111560?
Organizations running Barracuda Email Security Gateway, Web Application Firewall, Load Balancer ADC, Message Archiver, WAF Control Center or Web Security Gateway appliances.
