Skip to content

Vendor

barracuda vulnerabilities

20 published CVES affecting barracuda, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
20
Critical
9
High
6
Medium
5
Low
0
Unscored
0
CISA KEV
3
Atom feed of barracuda alerts

Products

Latest barracuda CVEs

Newest publication first

  2. CVE-2026-111560 OS Command Injection in Barracuda Appliances

    Published
    HighCVSS 8.6 EPSS 6.2% CISA KEV added 2026-11-10 Exploited in the wild

    Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is...

  5. CVE-2025-34393 Barracuda RMM < 2025.1.1 Service Center Insecure Reflection RCE

    Published
    CriticalCVSS 10.0 EPSS 0.76%

    Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name of an attacker-controlled WSDL service, leading to insecure reflection. This can result in remote code execution through either invocation of arbitrary...

  6. CVE-2025-34392 Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE

    Published
    CriticalCVSS 10.0 EPSS 26.3%

    Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload...

  8. CVE-2023-7102 Remote Code Execution (RCE) Vulnerability

    Published
    CriticalCVSS 9.8 EPSS 44.6% Framework module

    Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.

  9. CVE-2023-2868 Remote Code injection in Barracuda Email Security Gateway

    Published
    CriticalCVSS 9.8 EPSS 86.8% CISA KEV added 2023-05-26 Exploited in the wild Framework module

    A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives)....

  10. CVE-2023-26213 On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allo...

    Published
    HighCVSS 7.2 EPSS 7.9%

    On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name...

  12. CVE-2019-5648 LDAP Credential Exposure in Barracuda Load Balancer ADC

    Published
    MediumCVSS 6.5 EPSS 1.1%

    Authenticated, administrative access to a Barracuda Load Balancer ADC running unpatched firmware <= v6.4 allows one to edit the LDAP service configuration of the balancer and change the LDAP server to an attacker-controlled system, without having to re-enter LDAP credentials. The...

  14. CVE-2019-6724 The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unprivileged local attacker to load a malici...

    Published
    HighCVSS 7.8 EPSS 0.52%

    The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unprivileged local attacker to load a malicious library, resulting in arbitrary code executing as root.

  18. CVE-2017-6320 A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); fixed in 6.1.0.003 (2017-01-17)) in which...

    Published
    HighCVSS 8.8 EPSS 11.1%

    A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); fixed in 6.1.0.003 (2017-01-17)) in which an authenticated user can execute arbitrary shell commands and gain root privil...

  19. CVE-2015-0962 Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easi...

    Published
    MediumCVSS 4.3 EPSS 1.4%

    Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL session...

  20. CVE-2015-0961 Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and obtai...

    Published
    MediumCVSS 4.3 EPSS 0.75%

    Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.