Barracuda CVE-2026-111560: command injection exploited in the wild

What CVE-2026-111560 is and who is affectedCVE-2026-111560 is an OS command injection flaw (CWE-78) affecting several Barracuda Networks appliances th...

What CVE-2026-111560 is and who is affected

CVE-2026-111560 is an OS command injection flaw (CWE-78) affecting several Barracuda Networks appliances that share common Barracuda code. According to the National Vulnerability Database (NVD) of NIST, the problem lies in the timezone configuration field, where shell metacharacters are not properly neutralised. An authenticated administrator can inject operating system commands that then run with root privileges when the crafted timezone value is processed.

The affected products named by CISA are:

Barracuda Email Security Gateway (ESG)
Barracuda Load Balancer
Barracuda Application Delivery Controller (ADC)
Barracuda Message Archiver (BMA)
Barracuda WAF Control Center (WCC)
Barracuda Web Application Firewall (WAF)
Barracuda Web Security Gateway (WSG)

The vulnerability was published in the NVD on 2 November 2026 and carries a CVSS 4.0 score of 8.6 (HIGH), so we are talking about a grave flaw rather than a critical one. The attack vector is network-based and requires high privileges, but the impact on confidentiality, integrity and availability is high on all three counts. CISA also notes that it can be chained with CVE-2026-116606, which raises the practical risk for anyone running these appliances at the edge of their network.

In Spain, this matters most to small and mid-sized companies, online shops and in-house IT teams that deploy Barracuda equipment for email filtering, web application protection or load balancing, often without a dedicated security specialist watching it day to day.

Why it is urgent: already exploited, with a three-day deadline

This is not a theoretical flaw waiting for a proof of concept. CISA added CVE-2026-111560 to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026, which means there is confirmed evidence of exploitation in real attacks.

The deadline CISA gave US federal agencies was 13 November 2026, only three days later. That short window says a lot about how the agency rates the exposure: internet-facing security appliances with root-level command execution are exactly the kind of asset attackers look for first, because compromising one gives them a foothold behind the perimeter.

One clarification worth making: the KEV entry does not state that this vulnerability has been used in ransomware campaigns. That does not make it harmless. It simply means the confirmed abuse so far is not tied to ransomware, and the situation can change.

What to do today

The first step is an inventory. Check whether your organisation runs any of the Barracuda products listed above, and confirm the exact model and firmware version of each unit. Appliances bought years ago and quietly forgotten in a rack are the usual suspects.

Once identified, apply the update or mitigation indicated in Barracuda's own security advisory. The material available here does not specify which firmware version resolves the issue, so do not rely on guesswork: follow the vendor's published instructions and confirm the fixed release before considering the asset clean. CISA's guidance is explicit on this point, asking organisations to apply mitigations in line with vendor instructions and, where no mitigation is available, to discontinue use of the product.

Then look for signs of intrusion. Because the flaw requires an authenticated administrator, review administrator accounts, recent changes to timezone settings and any unexpected configuration edits. Check logs for commands or processes that should not be running on an appliance, and verify that no unauthorised accounts have been created.

Finally, reduce what is exposed to the internet. Administrative interfaces for email gateways, WAFs and load balancers should never be reachable from the open internet unless strictly necessary. Restrict management access to known addresses, enforce strong authentication and keep an eye on the chaining risk with CVE-2026-116606.

How a cybersecurity team such as ALMC's can help

For a small IT department, keeping pace with KEV additions, vendor advisories and firmware matrices is a job in itself. At ALMC we work with companies in Lleida, Barcelona, Tarragona and Girona on exactly this: security audits and pentesting to find exposed assets before someone else does, hardening of servers and appliances, and monitoring with incident response when something looks wrong.

We also handle the unglamorous but decisive part, which is keeping WordPress, PrestaShop and Joomla installations patched and up to date, and repairing websites that have already been hacked. The same discipline applies to network equipment: knowing what you have, what version it runs and what is reachable from outside is the difference between a routine patch and an incident. If you are unsure whether any of the Barracuda products above are part of your infrastructure, that inventory is a sensible place to start, and it is work we do routinely for SMEs and online shops across Catalonia.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.