Palo Alto Networks · Code execution
Barracuda Networks Multiple Products OS Command Injection Vulnerability
At a glance
Actively exploited in the wild — prioritise confirming exposure.
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on Palo Alto Networks, treat it as High.
Briefing
- Organisations using affected Barracuda Networks products should apply mitigations in accordance with vendor instructions and ensure compliance with CISA’s BOD 26-04 guidance for cloud services or discontinue use if mitigations are unavailable.
Questions to ask IT
- Do we run Palo Alto Networks, and which versions?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 17 Nov?
Next steps
- Confirm exposure and remediation status for affected products
Vulnerability facts
Full CVE detail CVE-2026-111560- 8.6 · HighExploitable over the network with an administrator-level account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Listed: attacks using it have been seen (on the catalogue since )
- ~1.1% estimated chance of attack in 30 days
- Not linked from the CVE record
These facts are for CVE-2026-111560. This event covers 1 more CVE, each with its own record.
- CVE-2026-111560 is confirmed as exploited in the wild (US known-exploited catalogue) and has an estimated ~1.1% chance of attack in 30 days as of 2026-11-10.
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- Barracuda Networks Multiple Products contain an OS command injection vulnerability that could allow an authenticated administrator to inject OS commands with root privileges when processing a crafted timezone value.
- The vulnerability can be chained with CVE-2026-116606 and is reported as exploited in the wild according to the US known-exploited catalogue.
Products and services involved
- Palo Alto Networks94% match confidence · CVE-2026-111560
Pulse
Last change 27m ago · Next recheck 11 Nov 2026, 03:32 UK time
- Story10 Nov 2026, 21:32 UK time · 27m ago
Linked reporting from CISA (official authority).
Read source (CISA Known Exploited Vulnerabilities)
1 entry so far. The timeline chart appears once this story has more history.
Sources
Barracuda Networks Multiple Products OS Command Injection Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ConfirmedHeadline90% confidence
Barracuda Networks Multiple Products OS Command Injection Vulnerability
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-111560
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2026-111560 is confirmed as exploited in the wild (US known-exploited catalogue)
- ConfirmedEstimated attack likelihood95% confidence
CVE-2026-111560 has an estimated ~1.1% chance of attack in 30 days (64.8th percentile) as of 2026-11-10 — probability signal, not confirmed exploitation
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-116606
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2026-116606 is confirmed as exploited in the wild (US known-exploited catalogue)
- ConfirmedEstimated attack likelihood95% confidence
CVE-2026-116606 has an estimated ~1.6% chance of attack in 30 days (76th percentile) as of 2026-11-10 — probability signal, not confirmed exploitation