CVE-2014-2595

CRITICAL ⚠ Exploit

Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS16.9%
Percentile97th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-613: CWE-613
◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by exploiting a permanent authentication token obtained from a query string.

BSID: BS-2020-GLOBAL-156855-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2014-2595?
A critical vulnerability in Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by exploiting a permanent authentication token obtained from a query string.
What is the CVSS score for CVE-2014-2595?
CVE-2014-2595 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 16.9%.
Is CVE-2014-2595 actively exploited?
Public exploit available for CVE-2014-2595. Exploitation risk elevated.
How do I remediate CVE-2014-2595?
Priority: IMMEDIATE.
What systems are affected by CVE-2014-2595?
CVE-2014-2595 affects Barracuda Web Application Firewall.
Vulnerability Details
CVE IDCVE-2014-2595
BSIDBS-2020-GLOBAL-156855-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2020-02-12
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-613
SourceNVD
Official Description

Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is due to the improper handling of permanent authentication tokens in the query string, which can be exploited by an attacker to gain unauthorized access without proper authentication.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Barracuda Web Application Firewall 7.8.1.013
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2438 Days
CISA known-exploitedNot in KEV catalog
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
Related CVEs affecting Barracuda
CVE-2023-2868 9.8 A remote command injection vulnerability exists in the Barracuda Email Securi... CVE-2023-7102 9.8 Use of a Third Party library produced a vulnerability in Barracuda Networks I... CVE-2014-8426 9.8 Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015. CVE-2014-8428 9.8 Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via t... CVE-2025-34392 9.8 Barracuda Service Center, as implemented in the RMM solution, in versions pri...
View all Barracuda CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →