SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
9 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-111560 · CVSS 8.6

Several Barracuda Networks products: attackers can run commands on it

AFFECTSBarracuda Networks Multiple ProductsBarracuda Networks Barracuda Email Security Gateway (esg)Barracuda Networks Barracuda Load Balancer Application Delivery Controller (adc)Barracuda Networks Barracuda Web Application Firewall (waf)Barracuda Networks Barracuda Web Security Gateway (wsg)Barracuda Networks Barracuda Message Archiver (bma)Barracuda Networks Barracuda Waf Control Center (wcc)

OFFICIAL NAME: Barracuda Networks Multiple Products OS Command Injection Vulnerability

DO THIS FIRSTFind out if you use it. If you do, apply the vendor's fix. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 8 days old, so many systems are likely still unpatched.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. The confirmation is 1 day old. 7 products are affected.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
PROOF OF CONCEPT
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    CVE-2026-111560 discussed publicly (CIRCL sighting). CVE-2026-111560 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    Exploitation of CVE-2026-111560 reported (CIRCL sighting). CISA Vulnrichment marks CVE-2026-111560 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-111560 published
  2. EXPLOIT CODE PUBLIC
    CIRCL Vulnerability-Lookup sightings
  3. FIRST ATTACK REPORT
    CVE List V5 and CISA Vulnrichment
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 8 days after disclosure. CISA listed it 8 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. CISA set Nov 13, 2026 as the deadline for US federal agencies. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. NOV 4, 2026
    Two Barracuda ESG Flaws Could Be Combined for Full Root Access; Patches Released
  2. NOV 8, 2026
    Security Affairs newsletter Round 603 by Pierluigi Paganini – INTERNATIONAL EDITION
  3. Attack activity. NOV 9, 2026
    Barracuda Networks Multiple Products OS Command Injection Vulnerability
  4. NOV 10, 2026
    Barracuda’s email security gateways bitten by make-me-root vulns
  5. NOV 10, 2026
    CVE-2026-111560 discussed publicly (CIRCL sighting) (16 reports)
  6. Attack activity. NOV 10, 2026
    CISA Vulnrichment marks CVE-2026-111560 as actively exploited
  7. Attack activity. NOV 10, 2026
    Exploitation of CVE-2026-111560 reported (CIRCL sighting)
  8. NOV 10, 2026
    Public proof of concept for CVE-2026-111560 (CIRCL sighting)

SOURCES

  1. [1] CIRCL Vulnerability-Lookup sightings: CVE-2026-111560 discussed publicly (CIRCL sighting), NOV 10
  2. [2] CIRCL Vulnerability-Lookup sightings: Public proof of concept for CVE-2026-111560 (CIRCL sighting), NOV 10
  3. [3] CIRCL Vulnerability-Lookup sightings: Exploitation of CVE-2026-111560 reported (CIRCL sighting), NOV 10
  4. [4] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-111560 as actively exploited, NOV 10
  5. [5] The Register (security): Barracuda’s email security gateways bitten by make-me-root vulns, NOV 10
  6. [6] CISA Known Exploited Vulnerabilities: Barracuda Networks Multiple Products OS Command Injection Vulnerability, NOV 9
  7. [7] Security Affairs: Security Affairs newsletter Round 603 by Pierluigi Paganini – INTERNATIONAL EDITION, NOV 8
  8. [8] Security Affairs: Two Barracuda ESG Flaws Could Be Combined for Full Root Access; Patches Released, NOV 4
  9. [9] CIRCL Vulnerability-Lookup sightings: 15 more reports