# Barracuda vulnerabilities > Barracuda has 14 published vulnerabilities across 35 products in our catalogue. 3 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Email Security Gateway 800 Firmware, with 2. If you run Barracuda software, patch the exploited flaws first. Canonical page: https://www.edgeprotect.io/vendors/barracuda ## At a glance - **Published vulnerabilities:** 14 - **Known to be exploited:** 3 - **Products:** 35 - **Versions:** 122 - **Most recently added to the known-exploited list:** [CVE-2026-116606](https://www.edgeprotect.io/what-is/cve-2026-116606), 10 November 2026. We keep watching the list. ## Which Barracuda products have the most vulnerabilities? - [Email Security Gateway 800 Firmware](https://www.edgeprotect.io/product/barracuda/email_security_gateway_800_firmware): 2 published vulnerabilities, 2 versions - [Email Security Gateway 900](https://www.edgeprotect.io/product/barracuda/email_security_gateway_900): 2 published vulnerabilities, 0 versions - [Email Security Gateway 900 Firmware](https://www.edgeprotect.io/product/barracuda/email_security_gateway_900_firmware): 2 published vulnerabilities, 2 versions - [Load Balancer](https://www.edgeprotect.io/product/barracuda/load_balancer): 2 published vulnerabilities, 1 version - [Load Balancer ADC](https://www.edgeprotect.io/product/barracuda/load_balancer_adc): 2 published vulnerabilities, 19 versions - [Email Security Gateway 300 Firmware](https://www.edgeprotect.io/product/barracuda/email_security_gateway_300_firmware): 2 published vulnerabilities, 2 versions - [Web Filter](https://www.edgeprotect.io/product/barracuda/web_filter): 2 published vulnerabilities, 6 versions - [Email Security Gateway 400](https://www.edgeprotect.io/product/barracuda/email_security_gateway_400): 2 published vulnerabilities, 0 versions - [Email Security Gateway 400 Firmware](https://www.edgeprotect.io/product/barracuda/email_security_gateway_400_firmware): 2 published vulnerabilities, 2 versions - [Email Security Gateway 600](https://www.edgeprotect.io/product/barracuda/email_security_gateway_600): 2 published vulnerabilities, 0 versions Each product page lists its own known-exploited flaws. ## Which Barracuda vulnerabilities are being exploited? 3 flaws are on the government list of vulnerabilities known to be exploited, newest first: - [CVE-2026-116606](https://www.edgeprotect.io/what-is/cve-2026-116606): Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability. Critical, CVSS 9.3, chance of use in 30 days 11%, known exploited since 10 November 2026. - [CVE-2026-111560](https://www.edgeprotect.io/what-is/cve-2026-111560): Barracuda Networks Multiple Products OS Command Injection Vulnerability. High, CVSS 8.6, chance of use in 30 days 9.1%, known exploited since 10 November 2026. - [CVE-2023-2868](https://www.edgeprotect.io/what-is/cve-2023-2868): Barracuda Networks ESG Appliance Improper Input Validation Vulnerability. Critical, CVSS 9.4, chance of use in 30 days 87%, known exploited since 26 May 2023. ## Which Barracuda flaws are most likely to be used? Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days): - [CVE-2023-2868](https://www.edgeprotect.io/what-is/cve-2023-2868): 87%, Critical (CVSS 9.4), known exploited - [CVE-2023-7102](https://www.edgeprotect.io/what-is/cve-2023-7102): 45%, Critical (CVSS 9.8) - [CVE-2025-34392](https://www.edgeprotect.io/what-is/cve-2025-34392): 26%, Critical (CVSS 10.0) - [CVE-2014-2595](https://www.edgeprotect.io/what-is/cve-2014-2595): 17%, Critical (CVSS 9.8) - [CVE-2017-6320](https://www.edgeprotect.io/what-is/cve-2017-6320): 11%, High (CVSS 8.8) - [CVE-2026-116606](https://www.edgeprotect.io/what-is/cve-2026-116606): 11%, Critical (CVSS 9.3), known exploited - [CVE-2026-111560](https://www.edgeprotect.io/what-is/cve-2026-111560): 9.1%, High (CVSS 8.6), known exploited - [CVE-2023-26213](https://www.edgeprotect.io/what-is/cve-2023-26213): 7.9%, High (CVSS 7.2) - [CVE-2014-8428](https://www.edgeprotect.io/what-is/cve-2014-8428): 2.4%, Critical (CVSS 9.8) - [CVE-2014-8426](https://www.edgeprotect.io/what-is/cve-2014-8426): 2.2%, Critical (CVSS 9.8) ## All Barracuda products we track 23 products with at least one tracked version, most vulnerabilities first: - [Email Security Gateway 800 Firmware](https://www.edgeprotect.io/product/barracuda/email_security_gateway_800_firmware): 2 vulnerabilities, 2 versions - [Email Security Gateway 900 Firmware](https://www.edgeprotect.io/product/barracuda/email_security_gateway_900_firmware): 2 vulnerabilities, 2 versions - [Load Balancer](https://www.edgeprotect.io/product/barracuda/load_balancer): 2 vulnerabilities, 1 version - [Load Balancer ADC](https://www.edgeprotect.io/product/barracuda/load_balancer_adc): 2 vulnerabilities, 19 versions - [Email Security Gateway 300 Firmware](https://www.edgeprotect.io/product/barracuda/email_security_gateway_300_firmware): 2 vulnerabilities, 2 versions - [Web Filter](https://www.edgeprotect.io/product/barracuda/web_filter): 2 vulnerabilities, 6 versions - [Email Security Gateway 400 Firmware](https://www.edgeprotect.io/product/barracuda/email_security_gateway_400_firmware): 2 vulnerabilities, 2 versions - [Email Security Gateway 600 Firmware](https://www.edgeprotect.io/product/barracuda/email_security_gateway_600_firmware): 2 vulnerabilities, 2 versions - [T600d Firmware](https://www.edgeprotect.io/product/barracuda/t600d_firmware): 1 vulnerability, 1 version - [T900b Firmware](https://www.edgeprotect.io/product/barracuda/t900b_firmware): 1 vulnerability, 1 version - [T93a Firmware](https://www.edgeprotect.io/product/barracuda/t93a_firmware): 1 vulnerability, 1 version - [VPN Client](https://www.edgeprotect.io/product/barracuda/vpn_client): 1 vulnerability, 3 versions - [Web Application Firewall](https://www.edgeprotect.io/product/barracuda/web_application_firewall): 1 vulnerability, 1 version - [Load Balancer ADC Firmware](https://www.edgeprotect.io/product/barracuda/load_balancer_adc_firmware): 1 vulnerability, 5 versions - [Message Archiver](https://www.edgeprotect.io/product/barracuda/message_archiver): 1 vulnerability, 1 version - [Message Archiver Firmware](https://www.edgeprotect.io/product/barracuda/message_archiver_firmware): 1 vulnerability, 55 versions - [Network Access Client](https://www.edgeprotect.io/product/barracuda/network_access_client): 1 vulnerability, 11 versions - [T100b Firmware](https://www.edgeprotect.io/product/barracuda/t100b_firmware): 1 vulnerability, 1 version - [T193a Firmware](https://www.edgeprotect.io/product/barracuda/t193a_firmware): 1 vulnerability, 1 version - [T200c Firmware](https://www.edgeprotect.io/product/barracuda/t200c_firmware): 1 vulnerability, 1 version - [T400c Firmware](https://www.edgeprotect.io/product/barracuda/t400c_firmware): 1 vulnerability, 1 version - [Load Balancer Firmware](https://www.edgeprotect.io/product/barracuda/load_balancer_firmware): 0 vulnerabilities, 1 version - [Yosemite Server Backup](https://www.edgeprotect.io/product/barracuda/yosemite_server_backup): 0 vulnerabilities, 2 versions ## Questions ### How many vulnerabilities does Barracuda have? Our catalogue lists 14 published vulnerabilities across 35 products and 122 versions from Barracuda. The most recent Barracuda flaw added to the known-exploited list is CVE-2026-116606, on 10 November 2026. ### Which Barracuda vulnerabilities are being exploited? 3 Barracuda vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2026-116606, CVE-2026-111560 and CVE-2023-2868. The full list is on this page. ### Which Barracuda product has the most vulnerabilities? Email Security Gateway 800 Firmware, with 2 published vulnerabilities. Its own page lists the ones known to be exploited. ### How do I get alerts for new Barracuda vulnerabilities? Create a EdgeProtect account and track the Barracuda products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook. ## Running Barracuda? EdgeProtect keeps checking for you: - **Tell us what you run.** Pick your software from a list, or let us work it out from your website. - **We match it to every flaw.** Over 400,000 published flaws, checked against your list. - **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it. - **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools. Start free (no card, nothing to install): https://www.edgeprotect.io/register Book a demo: https://www.edgeprotect.io/contact