CVE-2026-111560 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-11-02

Added to CISA KEV: 2026-11-10 8 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — PATCH IMMEDIATELY: Apply vendor-supplied firmware updates from the Barracuda Trust Center (https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection) for ALL affected product lines. Treat all six products as simultaneously vulnerable.
CRITICAL — INDICATOR OF COMPROMISE CHECK: Given confirmed active exploitation, treat all unpatched Barracuda appliances as potentially compromised. Review system logs for unexpected process execution, unauthorized timezone configuration changes, new cron jobs, reverse shell indicators, and unfamiliar outbound connections.
CRITICAL — ADDRESS CHAINED VULNERABILITY: CVE-2026-116606 (authorization bypass) is being actively used together with this CVE for pre-auth exploitation. Ensure patches for BOTH CVEs are applied. Do not treat patching one as sufficient.
URGENT — RESTRICT MANAGEMENT INTERFACE ACCESS: Immediately restrict access to appliance web management interfaces (admin consoles) to trusted management IP ranges only, via ACLs, firewall rules, or VPN. Eliminate direct internet exposure of admin interfaces where possible.
HIGH PRIORITY — NETWORK SEGMENTATION REVIEW: If any Barracuda appliance is confirmed compromised, assume attacker has root on a network-perimeter device with full visibility into traffic. Conduct network segmentation review and audit firewall rules for signs of pivot activity.
MONITORING: Deploy alerts for unauthorized configuration changes on Barracuda appliances, specifically timezone field modifications. Monitor for unexpected outbound connections from appliance management IPs.
MONITORING: Correlate appliance logs with SIEM for indicators matching watchTowr Labs public PoC patterns and CCB Alert IoCs.
PATCH PRIORITY: P1 — Critical. Patch within 24-48 hours given confirmed active exploitation and public PoC availability. Prioritize ESG and WAF instances with direct internet exposure first.

🔍 Web Intelligence (Kagi · 2026-11-10)

Summary

CVE-2026-111560 is a high-severity OS command injection vulnerability affecting certain Barracuda appliance products, including the Barracuda Email Security Gateway (ESG). The flaw stems from improper neutralization of shell metacharacters within the appliance's timezone configuration field. It is a significant security risk because it allows a malicious actor to inject and execute arbitrary OS commands with root privileges, effectively granting full control over the compromised appliance.

Exploitation

Active Exploitation: There are reports of active exploitation in the wild, often linked to broader campaigns targeting Barracuda ESG infrastructure alongside other vulnerabilities like CVE-2026-116606 ^[1].
Tooling: Detection artifacts and analysis regarding the exploitation of this vulnerability are publicly available, including resources from security research firms ^[3].
Prerequisites: While the base vulnerability requires an authenticated administrator to modify the timezone, it is frequently chained with other vulnerabilities (such as authorization bypasses) to achieve pre-authentication exploitation.
Interaction: Once an attacker gains the necessary access to the configuration interface, no further user interaction is required to trigger the command injection.

Affected Products & Patches

Affected Products: Certain Barracuda appliance products, specifically including the Barracuda Email Security Gateway (ESG), that utilize the vulnerable shared code for timezone configuration ^[2].
Patches: Users should consult the official Barracuda Trust Center for specific firmware update versions that address this vulnerability.
Mitigations: Organizations are advised to restrict administrative access to the appliance management interface to trusted networks only and to monitor for unauthorized configuration changes. Immediate application of vendor-supplied patches is strongly recommended.

Impact

Access Level: Successful exploitation provides the attacker with root-level access to the underlying operating system of the Barracuda appliance.
Capability: This level of access allows the attacker to execute arbitrary code, modify system files, install backdoors, intercept or manipulate email traffic, and pivot deeper into the internal network.
Business Risk: For internet-facing deployments, this vulnerability poses an extreme business risk. It can lead to complete compromise of sensitive email communications, data exfiltration, and the loss of integrity of critical security infrastructure, potentially causing significant operational disruption and data breach liabilities.

Sources

CCB Alert
Warning: Critical vulnerabilities in #Barracuda Email Security Gateway and other products. CVE-2026-116606 & CVE-2026-111560 CVSS: 9.3.
CVE-2026-111560 - Vulnerability Details - OpenCVE
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently proces…
GitHub - watchtowrlabs/watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560 · GitHub
Detection Artifact Generator for Barracuda Email Security Gateway (ESG) Auth bypass to comomand injection (CVE-2026-116606, CVE-2026-111560)…

🔴 CVE-2026-111560