OS command injection

CVE-2026-116606 and CVE-2026-111560 — Barracuda Email Security Gateway authentication bypass and OS command injection: explainer and fix (listed in KEV, due 13 November, compromise check required)

On 2 November 2026 Barracuda disclosed an authentication bypass in Email Security Gateway (ESG) (CVE-2026-116606, CVSS 9.3) and an OS command injection affecting ESG, ADC, BMA, WCC, WAF and WSG (CVE-2026-111560, CVSS 8.6). Both need access to the administrative interface, and combined they can lead to root. The advisory says exploitation has affected a small number of organizations (added 9 November). CISA added both to KEV on 10 November with a due date of 13 November, only three days later, and requires a forensic check. This site's view: do not stop at patching. Restrict the admin interface, preserve evidence before updating, and check for signs of compromise.