{"id":"EM-20261104-TAHY","url":"https://cyber.eventmonitor.net/incident/EM-20261104-TAHY/","type":"cve","title":"Barracuda Email Security Gateway Vulnerability (CVE-2026-111560)","subtitle":"CVE-2026-111560","subject":"CVE-2026-111560","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-04T09:41:25.000Z","firstSignal":"2026-11-02T13:17:35.190Z","lastSignal":"2026-11-04T09:41:25.000Z","updated":"2026-11-04T14:43:58.877Z","revision":1,"life":[{"status":"Born","at":"2026-11-04T09:41:25.000Z","why":"second independent source: C15 NCSC-NL"},{"status":"Developing","at":"2026-11-04T09:41:25.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-02T13:17:35.190Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-04T09:41:25.000Z","what":"Born: second source, C15 NCSC-NL. Page EM-20261104-TAHY created."}],"stages":[{"name":"Disclosed","at":"2026-11-02T13:17:35.190Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-02T13:17:35.190Z","detail":"CVSS 8.6 · EPSS 0.5%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":"2026-11-04T09:41:25.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-02T13:17:35.190Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-111560 (CVSS 8.6)","text":"Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111560"},{"at":"2026-11-04T09:41:25.000Z","source":"C15","sourceName":"NCSC-NL","role":"Government","severity":2,"title":"NCSC-2026-0465 [1.00] [M/H] Kwetsbaarheden verholpen in Barracuda Email Security Gateway","text":"Barracuda heeft kwetsbaarheden verholpen in Barracuda Email Security Gateway. Barracuda heeft twee kwetsbaarheden vastgesteld in verschillende Barracuda-producten: een kwetsbaarheid voor het omzeilen van autorisatiecontroles (CVE-2026-116606) en een kwetsbaarheid voor command injection (CVE-2026-111560). De eerste kwetsbaarheid betreft een pre-authentication authorization bypass in Barracuda Email","url":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0465"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-02T13:17:35.190","score":8.6,"severity":"HIGH","desc":"Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently proces","product":"","seen":1793803438877},"kev":null,"epss":{"epss":0.00471,"pct":0.40844,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}