KNOWN EXPLOITED VULNERABILITY DOSSIER
CVE-2026-111560
Barracuda Networks · Multiple Products
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606
Correlated Federal Court Cases & Exploitation Context (0)
No federal court indictment in the current archive directly cites CVE-2026-111560. This record tracks its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-11-10.
Associated Government Advisories
Tracked under CISA Known Exploited Vulnerabilities Binding Operational Directive 22-01 for federal civilian agency remediation.