Barracuda vulnerabilities3 known to be exploited.
Barracuda has 14 published vulnerabilities across 35 products in our catalogue. 3 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Email Security Gateway 800 Firmware, with 2. If you run Barracuda software, patch the exploited flaws first.
The most recent Barracuda flaw added to the known-exploited list is CVE-2026-116606, on 10 November 2026. We keep watching the known-exploited list.
Which Barracuda products have the most vulnerabilities?
Email Security Gateway 800 Firmware leads with 2 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Barracuda vulnerabilities are being exploited?
3 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.3Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and...
- 8.6Barracuda Networks Multiple Products OS Command Injection Vulnerability
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG)...
- 9.4Barracuda Networks ESG Appliance Improper Input Validation Vulnerability
Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.
Which Barracuda flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 87%
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006.
- 45%CVE-2023-7102Critical
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc.
- 26%CVE-2025-34392Critical
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application.
- 17%CVE-2014-2595Critical
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.
- 11%CVE-2017-6320High
A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); fixed in 6.1.0.003 (2017-01-17)) in which an...
- 11%
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible...
- 9.1%
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that...
- 7.9%CVE-2023-26213High
On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an...
- 2.4%CVE-2014-8428Critical
Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an improperly protected SSH key.
- 2.2%CVE-2014-8426Critical
Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015.
All Barracuda products we track.
23 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Email Security Gateway 300 Firmwareemail_security_gateway_300_firmware2 vulnerabilities2 versions
- Email Security Gateway 400 Firmwareemail_security_gateway_400_firmware2 vulnerabilities2 versions
- Email Security Gateway 600 Firmwareemail_security_gateway_600_firmware2 vulnerabilities2 versions
- Email Security Gateway 800 Firmwareemail_security_gateway_800_firmware2 vulnerabilities2 versions
- Email Security Gateway 900 Firmwareemail_security_gateway_900_firmware2 vulnerabilities2 versions
- Load Balancerload_balancer2 vulnerabilities1 version
- Load Balancer ADCload_balancer_adc2 vulnerabilities19 versions
- Web Filterweb_filter2 vulnerabilities6 versions
- Load Balancer ADC Firmwareload_balancer_adc_firmware1 vulnerability5 versions
- Message Archivermessage_archiver1 vulnerability1 version
- Message Archiver Firmwaremessage_archiver_firmware1 vulnerability55 versions
- Network Access Clientnetwork_access_client1 vulnerability11 versions
- T100b Firmwaret100b_firmware1 vulnerability1 version
- T193a Firmwaret193a_firmware1 vulnerability1 version
- T200c Firmwaret200c_firmware1 vulnerability1 version
- T400c Firmwaret400c_firmware1 vulnerability1 version
- T600d Firmwaret600d_firmware1 vulnerability1 version
- T900b Firmwaret900b_firmware1 vulnerability1 version
- T93a Firmwaret93a_firmware1 vulnerability1 version
- VPN Clientvpn_client1 vulnerability3 versions
- Web Application Firewallweb_application_firewall1 vulnerability1 version
- Load Balancer Firmwareload_balancer_firmware0 vulnerabilities1 version
- Yosemite Server Backupyosemite_server_backup0 vulnerabilities2 versions
This directory lists the 23 Barracuda products with at least one tracked version, of 35 in our catalogue.
Running Barracuda? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
- Matched to
- Barracuda on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 14 published vulnerabilities across 35 products and 122 versions from Barracuda. The most recent Barracuda flaw added to the known-exploited list is CVE-2026-116606, on 10 November 2026.
3 Barracuda vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2026-116606, CVE-2026-111560 and CVE-2023-2868. The full list is on this page.
Email Security Gateway 800 Firmware, with 2 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a EdgeProtect account and track the Barracuda products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.