Event Monitor Cyber
EM-20261104-TAHY VulnerabilityHigh severity

Barracuda Networks Multiple Products OS Command Injection Vulnerability

CVE-2026-111560 · Barracuda Networks Multiple Products

Share

191 hours from first report to confirmed exploitation.

Status
Confirmed

Since : CISA added it to Known Exploited Vulnerabilities.

First Signal
Nov 02 13:17 UTCC6 NVD CVE API 2.0
Page Born
Nov 04 09:41 UTCsecond source joined
Last Signal
Nov 10 12:00 UTC14 hours before snapshot
Sources
63 official · 3 research, news or crowd
Open For
8 daysso far

Life Of This Page

  1. 1
    Born
    A second, independent source names it.
  2. 2
    Developing
    New signals join; severity can move.
  3. 3
    Confirmed · Now
    CISA KEV lists it, or exploitation in the wild is reported.
  4. 4
    Resolved
    Not yet
    Past the fix deadline and 14 days with no new signal.
  5. 5
    Archived
    Not yet
    30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The ID never changes, and earlier addresses keep working. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

  1. Disclosed: reached
    Nov 02 13:17 UTC
    C6 NVD published
  2. Scored: reached
    Nov 02 13:17 UTC
    CVSS 8.6 · EPSS 0.5%
  3. Exploited: reached
    Nov 10 12:00 UTC
    C1 CISA KEV, fix by Nov 13
  4. Advisories: reached
    Nov 04 09:41 UTC
    2 government and CERT sources
  5. Vendor Response: not yet
    Not yet
    None in sources yet
  6. Resolved: not yet
    Not yet
    When fixed: KEV deadline Nov 13, then 14 quiet days

Timeline

Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9Nov 10BornConfirmedC6 NVD CVE API 2.0C15 NCSC-NLC160 Reddit r/netsecC171 GBHackersC1 CISA Known Exploited VulnerabilitC2 CISA Cybersecurity Advisories

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.

Signals

  1. CISA Adds Six Known Exploited Vulnerabilities to Catalog (opens source in a new tab) CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity… High severityGovernmentC2 CISA Cybersecurity Advisories
  2. CVE-2026-116606 added to KEV: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability (opens source in a new tab) Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and… High severityExploited ListC1 CISA Known Exploited Vulnerabilities
  3. CVE-2026-111560 added to KEV: Barracuda Networks Multiple Products OS Command Injection Vulnerability (opens source in a new tab) Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG)… High severityExploited ListC1 CISA Known Exploited Vulnerabilities
  4. Barracuda Email Security Gateway Flaws Allow Unauthenticated Attackers to Execute Commands as Root (opens source in a new tab) Two critical security vulnerabilities in Barracuda Email Security Gateway (ESG) could let unauthenticated attackers bypass authentication and run operating system commands as root. The vulnerabilities, tracked as… Med severityResearch & NewsC171 GBHackers
  5. Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560) - watchTowr Labs (opens source in a new tab) submitted by /u/dx7r__ to r/netsec [link] [comments] Info severityCrowdC160 Reddit r/netsec
  6. NCSC-2026-0465 [1.00] [M/H] Kwetsbaarheden verholpen in Barracuda Email Security Gateway (opens source in a new tab) Barracuda heeft kwetsbaarheden verholpen in Barracuda Email Security Gateway. Barracuda heeft twee kwetsbaarheden vastgesteld in verschillende Barracuda-producten: een kwetsbaarheid voor het omzeilen van… Med severityGovernmentC15 NCSC-NL
  7. CVE-2026-111560 (CVSS 8.6) (opens source in a new tab) Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that… High severityDatabaseC6 NVD CVE API 2.0