Barracuda Networks vulnerabilities
We track 8 vulnerabilities in Barracuda Networks products across 8 products. 8 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on November 2, 2026.
Latest Barracuda Networks vulnerabilities
- 9.8 Critical severity
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Exploited
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modific
- 7.2 High severity
Barracuda Networks Multiple Products OS Command Injection Exploited
Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the craft
- 7.8 High severity
RMM: Incorrect Permission Assignment for Critical Resource
Barracuda RMM versions prior to 2025.2.2 contain a privilege escalation vulnerability that allows local attackers to gain SYSTEM-level privileges by exploiting overly permissive filesystem ACLs on the C:\Windows\Automation directory. Attackers can modify exist
- 7.5 High severity
RMM: Improper Limitation of a Pathname to a Restricted Directory
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service in which an unauthenticated attacker can invoke a method vulnerable to path traversal to read arbitrary files. This vulnerability can b
- 9.8 Critical severity
RMM: Deserialization of Untrusted Data
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service that is insufficiently protected against deserialization of arbitrary types. This can lead to remote code execution.
- 9.8 Critical severity
RMM: Use of Externally-Controlled Input to Select Classes or Code
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name of an attacker-controlled WSDL service, leading to insecure reflection. This can result in remote code execution through either invo
- 9.8 Critical severity
RMM: Absolute Path Traversal
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution
- 9.8 Critical severity
Barracuda ESG Appliance: Use of Unmaintained Third Party Components
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable log