HighCVECVE-2026-111560
[CVE-2026-111560] Barracuda Networks Multiple Products — Barracuda Networks Multiple Products OS Command Injection Vulnerability
CISA KEV·Source published ·1 min read
What happened?
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.
Key details
- Linux Kernel missing variable initialization allows unintended page-cache data modification.
- Failure to preserve shared-fragment marker during socket buffer coalescing triggers the flaw.
- ESP input processing decrypts shared fragments in place due to the vulnerability.
- Vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells.
- Forensic triage is required per BOD 26-04 directive.
Affected
- Linux Kernel (open-source component used by multiple products).
Fixes and mitigations
- Apply mitigations per vendor instructions and BOD 26-04 guidance.
- Follow BOD 26-04 patching guidelines for internet-exposed assets.
Summarised by SecOraLens from CISA KEV. Always read the original source before acting. How SecOraLens verifies advisories.