CVE-2026-111560Barracuda Networks Barracuda Email Security Gateway (ESG) OS Command Injection

NVD

Vulnerability Summary

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

Severity Level

HIGH(8.6)

Published Date

Nov 2, 2026

Last Modified

Nov 11, 2026

Exploitation Status

ACTIVE

EPSS Score (30-Day)

9.08%Probability

Root Weakness (CWE)

CWE-78: OS Command Injection ↗

The software constructs all or part of an OS command using externally-influenced input, but does not properly neutralize special elements.

CVSS v4.0 Base Metrics — Score 8.6 (HIGH)

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack VectorNetwork

Attack ComplexityLow

Attack RequirementsNone

Privileges RequiredHigh

User InteractionNone

Confidentiality (Vulnerable System)High

Integrity (Vulnerable System)High

Availability (Vulnerable System)High

Confidentiality (Subsequent System)None

Integrity (Subsequent System)None

Availability (Subsequent System)None

Affected & Patched Versions

Affected Versions

Barracuda Networks Barracuda Email Security Gateway (ESG) <= 9.4.0.27
Barracuda Networks Barracuda Load Balancer Application Delivery Controller (ADC) <= 6.4.0
Barracuda Networks Barracuda Web Application Firewall (WAF) <= 11.0.1
Barracuda Networks Barracuda Web Security Gateway (WSG) <= 16.1.100.100
Barracuda Networks Barracuda Message Archiver (BMA) <= 5.5.4.0
Barracuda Networks Barracuda WAF Control Center (WCC) <= 2.2.1

Patched Versions

Barracuda Networks Barracuda Email Security Gateway (ESG) 9.4.0.27
Barracuda Networks Barracuda Load Balancer Application Delivery Controller (ADC) 6.4.0
Barracuda Networks Barracuda Web Application Firewall (WAF) 11.0.1
Barracuda Networks Barracuda Web Security Gateway (WSG) 16.1.100.100
Barracuda Networks Barracuda Message Archiver (BMA) 5.5.4.0
Barracuda Networks Barracuda WAF Control Center (WCC) 2.2.1

What to do

Patch now. CISA lists this flaw as exploited in the wild and set a federal remediation deadline of Nov 13, 2026.

Check whether you run Barracuda Networks Barracuda Email Security Gateway (ESG) and which version.
Update to a patched version listed above, then confirm the new version.
Review logs and exposed services for signs of earlier compromise.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA KEV Status

Listed in Known Exploited Vulnerabilities

Added: Nov 10, 2026
Remediation due: Nov 13, 2026 (deadline passed)

Timeline

Nov 2, 2026Published
Nov 10, 2026Added to CISA KEV catalog
Nov 11, 2026Record last modified
Nov 13, 2026KEV remediation due date

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Barracuda Networks Barracuda Email Security Gateway (ESG) CVEsYou are reading CVE-2026-111560. Get an email when KEV listings, exploits or new CVEs match your stack.

Set up CVE alerts

Related Coverage

External References

Data last checked: Nov 14, 2026 04:06 UTC