CVE-2026-111560

UNKNOWN

CISA KEV

Published 2026-11-02 · Updated 2026-11-10 · Source mandiant-cve@google.com

Summary

CVE-2026-111560 is a vulnerability in Barracuda Networks Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalog on November 10, 2026, which means exploitation in the wild has been confirmed; US federal agencies must remediate it by November 13, 2026. CISA does not currently list it as used in ransomware campaigns.

All 1 known-exploited Barracuda Networks vulnerabilities →

Description

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

CWE-78

CISA Known-Exploited Vulnerability

Product: Barracuda Networks — Multiple Products

Name: Barracuda Networks Multiple Products OS Command Injection Vulnerability

Date added: 2026-11-10 · Due: 2026-11-13

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

View on NVD

More exploited Barracuda Networks vulnerabilities

Most recently added to CISA KEV

CVE-2026-116606
Barracuda Email Security Gateway (ESG) — Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
added 2026-11-10
CVE-2023-2868
Email Security Gateway (ESG) Appliance — Barracuda Networks ESG Appliance Improper Input Validation Vulnerability
added 2023-05-26

View all →

Related CVEs

Same severity, most recent

CVE-2026-126187
React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.
2026-11-10 · score —
CVE-2026-0480
Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to forge SEV-TIO guest request messages potentially compromising SEV-SNP guest memory integrity and confidentiality.
2026-11-10 · score —
CVE-2026-0454
An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to corrupt global firmware variables, potentially resulting in loss of integrity.
2026-11-10 · score —
CVE-2026-0435
Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to swap out a guest device without the guest's knowledge, potentially resulting in a loss of confidentiality and integrity.
2026-11-10 · score —
CVE-2026-0003
Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality.
2026-11-10 · score —