Skip to content
OriginalSign in

CISA KEV alertCyberSIXT

CISA adds actively exploited Barracuda command injection flaw to KEV

Part of the CVE-2026-111560 story · since 2 Nov

Developinglatest 14 hours ago9 articles5 outlets
2 Nov · SecurityOnline first7 Nov9 NovNowThis article7th of 9
  • Mon 2 Nov, 17:00 UTC. SecurityOnline, first report. Barracuda fixes flaws that could give attackers appliance root access. Cites a CVE in CISA KEV.
  • Tue 3 Nov, 18:00 UTC. The Hacker News, its first report on the story. Barracuda flaws can be chained to gain root access. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 15:01 UTC. SecurityWeek, its first report on the story. Barracuda patches ESG flaws that can enable root access. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 22:30 UTC. Security Affairs, its first report on the story. Barracuda flaws can be chained to gain root access. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 08:00 UTC. The Hacker News. Researchers chain Barracuda flaws for unauthenticated root access. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 04:00 UTC. SecurityOnline. Attackers exploit Barracuda ESG flaws after PoC release. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:32 UTC. CISA, its first report on the story. CISA adds actively exploited Barracuda command injection flaw to KEV. Cites a CVE in CISA KEV. This article, 7th of 9.
  • Wed 11 Nov, 01:30 UTC. SecurityOnline. CISA adds six exploited flaws to its KEV catalogue. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 08:30 UTC. SecurityWeek. Barracuda flaws exploited to gain root access to devices. Cites a CVE in CISA KEV.

CISA added CVE-2026-111560 to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026. The Barracuda Networks Multiple Products OS Command Injection Vulnerability affects the Email Security Gateway, Load Balancer, Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.

The flaw is an OS command injection vulnerability. An authenticated administrator can inject commands through a crafted timezone value, which execute with root privileges when that value is processed. The issue can be chained with CVE-2026-116606. It has a CVSS score of 8.6 (High), and a patch is available.

CISA’s KEV listing confirms that the vulnerability is being actively exploited. Use in ransomware campaigns is unknown. CISA set 13 November 2026 as the remediation deadline.

CISA requires organisations to apply mitigations in line with Barracuda’s instructions and relevant BOD 26-04 guidance, including the Forensics Triage Requirements. For cloud services, organisations should follow applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Federal Civilian Executive Branch (FCEB) agencies are directly affected by the directive. All organisations should review their exposure and follow applicable patching guidance.

See the linked NVD entry and CISA KEV catalogue for full details.

How the story developed

All 9 articles
Developinglatest 14 hours ago9 articles5 outlets

9 articles from 5 outlets since 2 Nov. Picked up again on 10 Nov after 4 days quiet. This was the 7th report, 8 days after the first.

Now2 Nov45611First reportSecurityOnline · 2 Nov, 17:00This article7th of 9 · day 8
  • Mon 2 Nov, 17:00 UTC. SecurityOnline, first report. Barracuda fixes flaws that could give attackers appliance root access. Cites a CVE in CISA KEV.
  • Tue 3 Nov, 18:00 UTC. The Hacker News, its first report on the story. Barracuda flaws can be chained to gain root access. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 15:01 UTC. SecurityWeek, its first report on the story. Barracuda patches ESG flaws that can enable root access. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 22:30 UTC. Security Affairs, its first report on the story. Barracuda flaws can be chained to gain root access. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 08:00 UTC. The Hacker News. Researchers chain Barracuda flaws for unauthenticated root access. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 04:00 UTC. SecurityOnline. Attackers exploit Barracuda ESG flaws after PoC release. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:32 UTC. CISA, its first report on the story. CISA adds actively exploited Barracuda command injection flaw to KEV. Cites a CVE in CISA KEV. This article, 7th of 9.
  • Wed 11 Nov, 01:30 UTC. SecurityOnline. CISA adds six exploited flaws to its KEV catalogue. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 08:30 UTC. SecurityWeek. Barracuda flaws exploited to gain root access to devices. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Mon 2 NovDay 01
    1. Barracuda fixes flaws that could give attackers appliance root access17:00 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
  2. Tue 3 NovDay 11
    1. Barracuda flaws can be chained to gain root access18:00 · The Hacker News · Known exploited CVE
  3. Wed 4 NovDay 22
    1. Barracuda patches ESG flaws that can enable root access15:01 · SecurityWeek · Known exploited CVE
    2. Barracuda flaws can be chained to gain root access22:30 · Security Affairs · Known exploited CVE
  4. Fri 6 NovDay 41
    1. Researchers chain Barracuda flaws for unauthenticated root access08:00 · The Hacker News · Known exploited CVE

  5. Quiet for 4 days

    Tue 10 NovDay 82
    1. Attackers exploit Barracuda ESG flaws after PoC release04:00 · SecurityOnline · Picked up again · Known exploited CVE
    2. CISA adds actively exploited Barracuda command injection flaw to KEV20:32 · CISA · official · CISA alert · Known exploited CVE · This article, 7th of 9
  6. Wed 11 NovDay 92
    1. CISA adds six exploited flaws to its KEV catalogue01:30 · SecurityOnline · Known exploited CVE
    2. Barracuda flaws exploited to gain root access to devices08:30 · SecurityWeek · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in