CVE-2026-111560 KEV
7.2
HIGH · CVSS 3.1 · EPSS 6.2% (pctl 94)
Patch first
On CISA KEV — known exploited in the wild, due 2026-11-13.
Description
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
Scoring
| CVSS | 7.2 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 6.2% — more likely to be exploited than 94% of all CVEs |
| Weakness | CWE-78 |
| On CISA KEV | yes — remediate by 2026-11-13 |
| Public exploit | none known |
| Published | 2026-11-02 |
| Last modified | 2026-11-12 |
CISA KEV
| Name | Barracuda Networks Multiple Products OS Command Injection Vulnerability |
|---|---|
| Added | 2026-11-10 |
| Due | 2026-11-13 |
| Vendor / product | Barracuda Networks / Multiple Products |
| Ransomware use | none reported |
Affected (40)
| Vendor | Product |
|---|---|
| barracuda | email security gateway 300 |
| barracuda | email security gateway 300 firmware |
| barracuda | email security gateway 400 |
| barracuda | email security gateway 400 firmware |
| barracuda | email security gateway 600 |
| barracuda | email security gateway 600 firmware |
| barracuda | email security gateway 800 |
| barracuda | email security gateway 800 firmware |
| barracuda | email security gateway 900 |
| barracuda | email security gateway 900 firmware |
| barracuda | load balancer adc 340 |
| barracuda | load balancer adc 340vx |
| barracuda | load balancer adc 440 |
| barracuda | load balancer adc 440vx |
| barracuda | load balancer adc 540 |
| barracuda | load balancer adc 540vx |
| barracuda | load balancer adc 640 |
| barracuda | load balancer adc 640vx |
| barracuda | load balancer adc 641 |
| barracuda | load balancer adc 642 |
| barracuda | load balancer adc 840 |
| barracuda | load balancer adc 841 |
| barracuda | load balancer adc 842 |
| barracuda | load balancer adc firmware |
| barracuda | message archiver firmware |
| barracuda | web application firewall |
| barracuda | web security gateway 1010 |
| barracuda | web security gateway 1011 |
| barracuda | web security gateway 210 |
| barracuda | web security gateway 310 |
| barracuda | web security gateway 310vx |
| barracuda | web security gateway 410 |
| barracuda | web security gateway 410vx |
| barracuda | web security gateway 610 |
| barracuda | web security gateway 610b |
| barracuda | web security gateway 610vx |
| barracuda | web security gateway 810 |
| barracuda | web security gateway 810b |
| barracuda | web security gateway 910 |
| barracuda | web security gateway firmware |
References
→ the Explorer · watch your stack · NVD