CISA adds Barracuda OS command injection to KEV

CISA added CVE-2026-111560, an OS command injection flaw affecting Barracuda ESG, Load Balancer, ADC, BMA, WCC, WAF, and WSG, to the KEV catalog. Authenticated administrators can inject OS commands executing with root privileges via crafted timezone values. Combined with CVE-2026-116606, it enables unauthenticated root compromise. Federal patch deadline is November 13, 2026.