OS Command Injection Vulnerability
Exploited in the wild. CISA added it to its Known Exploited Vulnerabilities list on 10 Nov 2026.
6.2%
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-111560. Nothing runs until you send it.
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606
You are affected if
The fix