Cross-site scripting in Barracuda Message Archiver

MEDIUM 60CWE-79Published 2025-07-29 · Updated 2025-07-30

Key facts

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00293 21st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Barracuda Message Archiver (Barracuda): 5.4.2.002

CISA ADP · SSVC 2.0.3

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Vendor	Product	Affected versions	Fixed in	Status	Source
Barracuda	Barracuda Message Archiver	5.4.2.002 to before 5.4.2.002	5.4.2.002	Patch available	CNA

Barracuda Message Archiver VendorBarracuda Affected 5.4.2.002 to before 5.4.2.002 Fixed in 5.4.2.002 Patch available CNA

CPE	Versions	Role	Vendor
cpe:2.3:o:barracuda:message_archiver_firmware:5.4.2.002:::::::*	5.4.2.002	Vulnerable	Barracuda

cpe:2.3:o:barracuda:message_archiver_firmware:5.4.2.002:*:*:*:*:*:*:* Versions 5.4.2.002 Vulnerable ·Barracuda

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences