Product

barracuda web application firewall vulnerabilities

2 published CVES affecting barracuda web application firewall, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 2
Critical: 1
High: 1
Medium: 0
Low: 0
Unscored: 0
CISA KEV: 1

Latest barracuda web application firewall CVEs

Newest publication first

CVE-2026-111560 OS Command Injection in Barracuda Appliances
Published 2026-11-02

HighCVSS 8.6 EPSS 6.2% CISA KEV added 2026-11-10 Exploited in the wild

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is...
CVE-2014-2595 Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.
Published 2020-02-12

CriticalCVSS 9.8 EPSS 16.9%

Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.

barracuda web application firewall vulnerabilities

Latest barracuda web application firewall CVEs

CVE-2026-111560 OS Command Injection in Barracuda Appliances

CVE-2014-2595 Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.