Barracuda Networks Multiple Products OS Command Injection Vulnerability

Exploited in the wild. Listed by CISA on 2026-11-10; known to be used by ransomware.

6.2%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Nonecheck to confirm it

Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606

No ready check is stored for this CVE. Confirm it by hand from the references.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-111560

Use this check only on systems you are authorised to test. Where the data comes from