CISA has added CVE-2026-111560 to its Known Exploited Vulnerabilities (KEV) catalog. It is an OS command injection flaw in the timezone setting shared across several Barracuda appliance products, and it gives an authenticated administrator code execution as root.
What Is It
CVE-2026-111560 is an OS command injection vulnerability (CWE-78). It is caused by improper neutralization of shell metacharacters in the timezone configuration field. The affected Barracuda appliances share common code, so the flaw shows up across several product lines. An authenticated administrator can inject OS commands into the timezone value. Those commands run with root privileges when the appliance later processes the value.
Mandiant (via [email protected]) gives the flaw a CVSS 4.0 base score of 8.6 (HIGH): network attack vector, low attack complexity, no user interaction, and high privileges required. CISA's KEV entry says the flaw can be chained with CVE-2026-116606.
Why It Matters
CISA KEV confirms active exploitation. The entry was added on 2026-11-10, and CISA's SSVC assessment rates exploitation as "active" with "total" technical impact. The bug needs admin privileges, but the KEV entry notes it can be chained with another CVE, and the payload runs as root. CISA has also flagged the entry for forensic triage, which means organizations should check for compromise as well as patch. KEV lists known ransomware campaign use as "Unknown."
What's Vulnerable
According to the NVD record, the following versions are affected:
- Barracuda Email Security Gateway (ESG): through 9.4.0.27
- Barracuda Load Balancer ADC: through 6.4.0
- Barracuda Web Application Firewall (WAF): through 11.0.1
- Barracuda Web Security Gateway (WSG): through 16.1.100.100
- Barracuda Message Archiver (BMA): through 5.5.4.0
- Barracuda WAF Control Center (WCC): through 2.2.1
Patch Status
CISA requires agencies to apply mitigations according to Barracuda's instructions and to follow BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. If no mitigations are available, agencies must follow the BOD 26-04 guidance for cloud services or stop using the product. Stakeholders must also evaluate each asset's internet exposure. The federal remediation deadline is 2026-11-13. The supplied data does not name specific fixed versions, so check Barracuda's advisory for remediation details. NVD analysis is still in progress ("Undergoing Analysis").