CVE-2026-111560: Barracuda Networks Multiple Products OS Command Injection

# CVE-2026-111560: Barracuda Networks Multiple Products OS Command Injection

https://gcdradar.vercel.app/incidents/cve-2026-111560-barracuda-networks-multiple-products-os-comm · AIR-2026-1880 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Exploited in the wild as confirmed by CISA KEV.
- Fix status: Partly patched
- First reported: 2026-11-10
- AI role: No AI role
- Products: Barracuda Networks Multiple Products
- CVE ids: CVE-2026-111560

## Summary

An OS command injection vulnerability in multiple Barracuda Networks products allows authenticated administrators to execute root commands via a crafted timezone value. CISA confirmed exploitation in the wild and added the flaw to its KEV catalog.

## What to do

Apply mitigations in accordance with vendor instructions and CISA BOD 26-04 guidance.

## Latest updates

- 2026-11-10: CVE-2026-111560: Barracuda Networks Multiple Products — Barracuda Networks Multiple Products OS Command Injection Vulnerability (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111560)

## Sources

- 2026-11-10 CISA: CVE-2026-111560: Barracuda Networks Multiple Products — Barracuda Networks Multiple Products OS Command Injection Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111560
- 2026-11-11 SecurityWeek: Recently Patched Barracuda Vulnerabilities Exploited in Attacks https://securityweek.com/recently-patched-barracuda-vulnerabilities-exploited-in-attacks

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.