/
Command Injection Vulnerability in Certain Barracuda Networks Products

Command Injection Vulnerability in Certain Barracuda Networks Products

Subscribe

Overview

Barracuda Networks has identified a vulnerability affecting certain Barracuda Networks products: a command injection vulnerability assigned CVE-2026-111560.

Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited, this vulnerability could allow an attacker to bypass authorization controls and obtain root access to the device.

Barracuda Networks immediately initiated a comprehensive remediation process and has released security patches for affected products. Customers should review the affected products and remediation guidance below and ensure their systems are running the latest firmware version and the appropriate security patch has been applied.

Affected versions of Web Application Firewall

All versions of the Web Application Firewall (WAF).

Has Barracuda Networks released a patch?

Yes. Barracuda Networks released a firmware patch for appliances running firmware version 11.0.1 through 12.3.0.011.

Action required

Appliances running versions earlier than 11.0.1 should be upgraded to version 12.3.0.011 or later.

  1. Log in to the Barracuda WAF web interface as an administrator.

  2. Go to Advanced > Firmware Update.

  3. Check the Current Installed Version.

  4. If the appliance is running version 11.0.1 through 12.3.0.011, the security patch will be installed automatically. If the appliance is running a version earlier than 11.0.1, download the latest general release from the Firmware Download section and update the firmware to version 11.0.1 or later.

  5. Allow the patch to complete and reboot the appliance if prompted.

How do I confirm whether my appliance has received the security patch?

  1. Log in to the Barracuda WAF web interface.

  2. Go to Advanced > Firmware Update.

  3. Check the Current Installed Version.

  4. If the appliance is running firmware version 11.0.1 or later, the appliance has received the security patch.

  5. If the appliance is running an earlier affected firmware version, follow the steps in Action required (above) to update the appliance to firmware version 11.0.1 or later.

Additional resources

We value your feedback.
If you have questions, suggestions, or feedback on our documentation, contact the Campus Product Documentation team.
For general product inquiries or technical support, please contact the global Barracuda Support team.