{"uuid": "db1a53cf-c399-45d8-9b59-a2bc7c311e6a", "vulnerability": {"vulnId": "CVE-2026-111560", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "db1a53cf-c399-45d8-9b59-a2bc7c311e6a"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-11-10T19:20:53+00:00"}, "timestamps": {"asserted_at": "2026-11-10T19:20:53+00:00", "recorded_at": "2026-11-11T20:00:01+00:00", "first_seen_at": "2026-11-10T19:20:53+00:00"}, "scope": {"notes": "OS Command Injection in Barracuda Appliances | Affected: Barracuda / Barracuda Email Security Gateway (ESG), Barracuda Load Balancer Application Delivery Controller (ADC), Barracuda Web Application Firewall (WAF), Barracuda Web Security Gateway (WSG), Barracuda Message Archiver (BMA), Barracuda WAF Control Center (WCC) | CVSS: 8.6 (HIGH) | EPSS: 0.0106 | Used in malware: unknown | Not yet in CISA KEV: False"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "OS Command Injection in Barracuda Appliances", "cve_id": "CVE-2026-111560", "vendor": "Barracuda", "ghsa_id": null, "product": "Barracuda Email Security Gateway (ESG), Barracuda Load Balancer Application Delivery Controller (ADC), Barracuda Web Application Firewall (WAF), Barracuda Web Security Gateway (WSG), Barracuda Message Archiver (BMA), Barracuda WAF Control Center (WCC)", "added_date": "2026-11-10T19:20:53.998Z", "cvss_score": 8.6, "epss_score": 0.0106, "previous_ids": [], "cvss_severity": "HIGH", "virtual_patch": false, "cvss_estimated": false, "epss_percentile": 0.6483, "used_in_malware": "unknown", "vulnerability_id": "CVE-2026-111560", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": false}}], "references": [{"id": "CVE-2026-111560", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111560"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-111560"}]}