[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fp0NmMMfsbeH9tDFUnjbdGyJybLbEPCzi73A--kp0g08":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":140,"kevVulnerabilities":198,"topProductsByCves":212,"seoMetadata":223,"meta":232},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":139},3133,"barracuda",35,14,1,122,"2025-07-30","b",[16,21,25,28,32,37,40,45,48,51,54,57,60,63,67,70,73,76,79,84,88,91,95,99,103,108,111,114,117,120,123,126,129,132,136],{"id":17,"product_name":18,"version_count":19,"cve_count":19,"kev_count":11,"last_cve_update":20},12812,"email_security_gateway_800_firmware",2,"2023-12-24",{"id":22,"product_name":23,"version_count":24,"cve_count":19,"kev_count":11,"last_cve_update":20},12813,"email_security_gateway_900",0,{"id":26,"product_name":27,"version_count":19,"cve_count":19,"kev_count":11,"last_cve_update":20},12814,"email_security_gateway_900_firmware",{"id":29,"product_name":30,"version_count":11,"cve_count":19,"kev_count":24,"last_cve_update":31},12815,"load_balancer","2017-08-28",{"id":33,"product_name":34,"version_count":35,"cve_count":19,"kev_count":24,"last_cve_update":36},12816,"load_balancer_adc",19,"2020-03-12",{"id":38,"product_name":39,"version_count":19,"cve_count":19,"kev_count":11,"last_cve_update":20},12806,"email_security_gateway_300_firmware",{"id":41,"product_name":42,"version_count":43,"cve_count":19,"kev_count":24,"last_cve_update":44},12838,"web_filter",6,"2015-05-25",{"id":46,"product_name":47,"version_count":24,"cve_count":19,"kev_count":11,"last_cve_update":20},12807,"email_security_gateway_400",{"id":49,"product_name":50,"version_count":19,"cve_count":19,"kev_count":11,"last_cve_update":20},12808,"email_security_gateway_400_firmware",{"id":52,"product_name":53,"version_count":24,"cve_count":19,"kev_count":11,"last_cve_update":20},12809,"email_security_gateway_600",{"id":55,"product_name":56,"version_count":24,"cve_count":19,"kev_count":11,"last_cve_update":20},12805,"email_security_gateway_300",{"id":58,"product_name":59,"version_count":19,"cve_count":19,"kev_count":11,"last_cve_update":20},12810,"email_security_gateway_600_firmware",{"id":61,"product_name":62,"version_count":24,"cve_count":19,"kev_count":11,"last_cve_update":20},12811,"email_security_gateway_800",{"id":64,"product_name":65,"version_count":11,"cve_count":11,"kev_count":24,"last_cve_update":66},12831,"t600d_firmware","2023-03-03",{"id":68,"product_name":69,"version_count":24,"cve_count":11,"kev_count":24,"last_cve_update":66},12832,"t900b",{"id":71,"product_name":72,"version_count":11,"cve_count":11,"kev_count":24,"last_cve_update":66},12833,"t900b_firmware",{"id":74,"product_name":75,"version_count":24,"cve_count":11,"kev_count":24,"last_cve_update":66},12834,"t93a",{"id":77,"product_name":78,"version_count":11,"cve_count":11,"kev_count":24,"last_cve_update":66},12835,"t93a_firmware",{"id":80,"product_name":81,"version_count":82,"cve_count":11,"kev_count":24,"last_cve_update":83},12836,"vpn_client",3,"2019-03-21",{"id":85,"product_name":86,"version_count":11,"cve_count":11,"kev_count":24,"last_cve_update":87},12837,"web_application_firewall","2020-02-12",{"id":89,"product_name":90,"version_count":24,"cve_count":11,"kev_count":24,"last_cve_update":66},12822,"t100b",{"id":92,"product_name":93,"version_count":94,"cve_count":11,"kev_count":24,"last_cve_update":36},12817,"load_balancer_adc_firmware",5,{"id":96,"product_name":97,"version_count":11,"cve_count":11,"kev_count":24,"last_cve_update":98},12819,"message_archiver","2018-12-23",{"id":100,"product_name":101,"version_count":102,"cve_count":11,"kev_count":24,"last_cve_update":13},12820,"message_archiver_firmware",55,{"id":104,"product_name":105,"version_count":106,"cve_count":11,"kev_count":24,"last_cve_update":107},12821,"network_access_client",11,"2021-12-01",{"id":109,"product_name":110,"version_count":11,"cve_count":11,"kev_count":24,"last_cve_update":66},12823,"t100b_firmware",{"id":112,"product_name":113,"version_count":24,"cve_count":11,"kev_count":24,"last_cve_update":66},12824,"t193a",{"id":115,"product_name":116,"version_count":11,"cve_count":11,"kev_count":24,"last_cve_update":66},12825,"t193a_firmware",{"id":118,"product_name":119,"version_count":24,"cve_count":11,"kev_count":24,"last_cve_update":66},12826,"t200c",{"id":121,"product_name":122,"version_count":11,"cve_count":11,"kev_count":24,"last_cve_update":66},12827,"t200c_firmware",{"id":124,"product_name":125,"version_count":24,"cve_count":11,"kev_count":24,"last_cve_update":66},12828,"t400c",{"id":127,"product_name":128,"version_count":11,"cve_count":11,"kev_count":24,"last_cve_update":66},12829,"t400c_firmware",{"id":130,"product_name":131,"version_count":24,"cve_count":11,"kev_count":24,"last_cve_update":66},12830,"t600d",{"id":133,"product_name":134,"version_count":11,"cve_count":24,"kev_count":24,"last_cve_update":135},12818,"load_balancer_firmware",null,{"id":137,"product_name":138,"version_count":19,"cve_count":24,"kev_count":24,"last_cve_update":135},12839,"yosemite_server_backup","Barracuda is a technology vendor with 35 tracked products and 14 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[141,149,155,162,166,173,179,184,189,194],{"cveId":142,"description":143,"publishedDate":144,"cvssScore":145,"cvssVersion":146,"severity":147,"isKev":4,"epssScore":148},"CVE-2023-2868","A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.","2023-05-24",9.4,"v3.1","Critical",0.86841,{"cveId":150,"description":151,"publishedDate":20,"cvssScore":152,"cvssVersion":146,"severity":147,"isKev":153,"epssScore":154},"CVE-2023-7102","Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.\n\n",9.8,false,0.44575,{"cveId":156,"description":157,"publishedDate":158,"cvssScore":159,"cvssVersion":160,"severity":147,"isKev":153,"epssScore":161},"CVE-2025-34392","Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.","2025-12-10",10,"v4.0",0.26315,{"cveId":163,"description":164,"publishedDate":87,"cvssScore":152,"cvssVersion":146,"severity":147,"isKev":153,"epssScore":165},"CVE-2014-2595","Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.",0.16868,{"cveId":167,"description":168,"publishedDate":169,"cvssScore":170,"cvssVersion":146,"severity":171,"isKev":153,"epssScore":172},"CVE-2017-6320","A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); fixed in 6.1.0.003 (2017-01-17)) in which an authenticated user can execute arbitrary shell commands and gain root privileges. The vulnerability stems from unsanitized data being processed in a system call when the delete_assessment command is issued.","2017-07-18",8.8,"High",0.11081,{"cveId":174,"description":175,"publishedDate":176,"cvssScore":177,"cvssVersion":160,"severity":147,"isKev":4,"epssScore":178},"CVE-2026-116606","An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.","2026-11-02",9.3,0.08934,{"cveId":180,"description":181,"publishedDate":66,"cvssScore":182,"cvssVersion":146,"severity":171,"isKev":153,"epssScore":183},"CVE-2023-26213","On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in \u002Fajax\u002Fupdate_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters.",7.2,0.07878,{"cveId":185,"description":186,"publishedDate":176,"cvssScore":187,"cvssVersion":160,"severity":171,"isKev":4,"epssScore":188},"CVE-2026-111560","Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.",8.6,0.06196,{"cveId":190,"description":191,"publishedDate":31,"cvssScore":152,"cvssVersion":192,"severity":147,"isKev":153,"epssScore":193},"CVE-2014-8428","Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an improperly protected SSH key.","v3.0",0.02376,{"cveId":195,"description":196,"publishedDate":31,"cvssScore":152,"cvssVersion":192,"severity":147,"isKev":153,"epssScore":197},"CVE-2014-8426","Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015.",0.02234,[199,204,207],{"cveId":174,"description":175,"publishedDate":176,"cvssScore":177,"cvssVersion":160,"severity":147,"isKev":4,"epssScore":178,"cisaVulnName":200,"cisaDateAdded":201,"cisaShortDescription":202,"cisaRequiredAction":203},"Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability","2026-11-10","Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",{"cveId":185,"description":186,"publishedDate":176,"cvssScore":187,"cvssVersion":160,"severity":171,"isKev":4,"epssScore":188,"cisaVulnName":205,"cisaDateAdded":201,"cisaShortDescription":206,"cisaRequiredAction":203},"Barracuda Networks Multiple Products OS Command Injection Vulnerability","Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606",{"cveId":142,"description":143,"publishedDate":144,"cvssScore":145,"cvssVersion":146,"severity":147,"isKev":4,"epssScore":148,"cisaVulnName":208,"cisaDateAdded":209,"cisaShortDescription":210,"cisaRequiredAction":211},"Barracuda Networks ESG Appliance Improper Input Validation Vulnerability","2023-05-26","Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.","Apply updates per vendor instructions.",[213,214,215,216,217,218,219,220,221,222],{"id":17,"product_name":18,"version_count":19,"cve_count":19,"kev_count":11,"last_cve_update":20},{"id":22,"product_name":23,"version_count":24,"cve_count":19,"kev_count":11,"last_cve_update":20},{"id":26,"product_name":27,"version_count":19,"cve_count":19,"kev_count":11,"last_cve_update":20},{"id":29,"product_name":30,"version_count":11,"cve_count":19,"kev_count":24,"last_cve_update":31},{"id":33,"product_name":34,"version_count":35,"cve_count":19,"kev_count":24,"last_cve_update":36},{"id":38,"product_name":39,"version_count":19,"cve_count":19,"kev_count":11,"last_cve_update":20},{"id":41,"product_name":42,"version_count":43,"cve_count":19,"kev_count":24,"last_cve_update":44},{"id":46,"product_name":47,"version_count":24,"cve_count":19,"kev_count":11,"last_cve_update":20},{"id":49,"product_name":50,"version_count":19,"cve_count":19,"kev_count":11,"last_cve_update":20},{"id":52,"product_name":53,"version_count":24,"cve_count":19,"kev_count":11,"last_cve_update":20},{"title":224,"metaDescription":225,"keywords":226,"structuredData":227},"Barracuda - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Barracuda covering 35 products with 14 tracked vulnerabilities including 2 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Barracuda vulnerabilities, Barracuda security, Barracuda CVE, Barracuda threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Barracuda KEV, Barracuda exploited vulnerabilities",{"@context":228,"@type":229,"name":230,"description":225,"url":231},"https:\u002F\u002Fschema.org","Organization","Barracuda","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fbarracuda",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":233,"apiVersion":234},"2026-11-13T15:43:43.053Z","3.0"]