Barracuda
8 CVEs across 37 Barracuda products. Browse Barracuda vulnerabilities, severities, and proof-of-concept exploits.
Barracuda products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-34395 | High | 7.5 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service in which an unauthenticated attack… |
CVE-2025-34394 | Critical | 9.8 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service that is insufficiently protected a… |
CVE-2025-34393 | Critical | 9.8 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name of an attacker-controlled WSDL… |
CVE-2025-34392 | Critical | 9.8 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL tha… |
CVE-2025-8319 | Medium | 6.1 | 2025-07-30 | the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter |
CVE-2023-7102 | Critical | 9.8 | 2023-12-24 | Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected… |
CVE-2023-2868 | Critical | 9.4 | 2023-05-24 | A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0… |
CVE-2023-26213 | High | 7.2 | 2023-03-03 | On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_… |
CVE-2021-42711 | High | 7.8 | 2021-12-01 | Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. This file is executed with SYSTEM privileges wh… |
CVE-2019-5648 | Medium | 6.5 | 2020-03-12 | Authenticated, administrative access to a Barracuda Load Balancer ADC running unpatched firmware <= v6.4 allows one to edit the LDAP service configuration of t… |
CVE-2014-2595 | Critical | 9.8 | 2020-02-12 | Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained fro… |
CVE-2019-6724 | High | 7.8 | 2019-03-21 | The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unp… |
CVE-2018-20369 | Medium | 6.1 | 2018-12-23 | Barracuda Message Archiver 2018 has XSS in the error_msg exception-handling value for the ldap_user parameter to the cgi-mod/ldap_load_entry.cgi module. The in… |
CVE-2014-8428 | Critical | 9.8 | 2017-08-28 | Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an improperly protected SSH key. |
CVE-2014-8426 | Critical | 9.8 | 2017-08-28 | Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015. |
CVE-2017-6320 | High | 8.8 | 2017-07-18 | A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19)… |
CVE-2015-0962 | | 2015-05-25 | Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different cust… | |
CVE-2015-0961 | | 2015-05-25 | Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-mi… |