A command injection flaw in Barracuda products is now being exploited in the wild, and it reaches far beyond the company’s email gateway. CVE-2026-111560 affects six Barracuda product lines, and the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue on 10 November, with a remediation deadline of 13 November for federal civilian agencies.

The flaw sits in the timezone configuration setting and lets crafted input run as operating-system commands. Barracuda rates it 8.6 on the CVSS scale. On its own it needs administrative access, but chained with a second flaw, an authorisation bypass in the Email Security Gateway tracked as CVE-2026-116606, it can give an unauthenticated attacker root access to the appliance.

Six products affected by CVE-2026-111560

Besides the Email Security Gateway, the command injection flaw affects the Load Balancer Application Delivery Controller, the Message Archiver, the Web Application Firewall, the WAF Control Center and the Web Security Gateway. Affected versions include Email Security Gateway 9.4.0.27 and earlier, Load Balancer ADC 6.4.0 and earlier, Web Application Firewall 11.0.1 and earlier, Web Security Gateway 16.1.100.100 and earlier, Message Archiver 5.5.4.0 and earlier, and WAF Control Center 2.2.1 and earlier.

Exploitation confirmed by Barracuda

Barracuda disclosed both flaws on 2 November and released patches the same day. On 9 November it updated its advisory to say it had identified exploitation activity affecting a small number of organisations. It has not said how many organisations were hit or what the attackers did after gaining access.

Organisations should apply the Barracuda patches now and, because the flaws are listed for forensic triage, check appliances for signs of compromise rather than relying on patch level alone.