CVE-2026-111560: Barracuda Networks Multiple Products OS Command Injection Vulnerability
High⚠ Actively exploited (CISA KEV)
High
Severity
Active
CISA KEV
No
Ransomware use
Nov 13, 2026
Patch deadline
⚠ Exploited in the wild. CISA added CVE-2026-111560 to its Known Exploited Vulnerabilities catalog on Nov 10, 2026, with a federal patch deadline of Nov 13, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web…
Details
AffectedBarracuda Networks · Multiple Products
WeaknessCWE-78
Added to CISA KEVNov 10, 2026
Federal patch deadlineNov 13, 2026
Known ransomware useNot documented
Frequently asked questions
Is CVE-2026-111560 being actively exploited?
Yes — CISA lists CVE-2026-111560 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.
What does CVE-2026-111560 affect?
CVE-2026-111560 affects Barracuda Networks · Multiple Products.
How do I fix CVE-2026-111560?
Apply the vendor’s patch for the affected software. The federal patch deadline was Nov 13, 2026. Then check whether your personal data was exposed in any related breach.