Known Exploited Vulnerabilities November 10, 2026 · CISA KEV Catalog

CVE-2026-111560: Barracuda Networks Multiple Products OS Command Injection Vulnerability

Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606

Read the original at CISA KEV Catalog ↗

Topics: Vulnerabilities & Patching
Mentions: Barracuda Networks CVE-2026-111560
Related: CISA Adds Six Known Exploited Vulnerabilities to Catalog Cyber Risks · Nov 10, 2026
CVE-2026-116606: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability Known Exploited Vulnerabilities · Nov 10, 2026
CVE-2023-2868: Barracuda Networks ESG Appliance Improper Input Validation Vulnerability Known Exploited Vulnerabilities · May 26, 2023