The research appeared as a Barracuda Threat Spotlight by senior product manager Aravind K. Sastry. The post was first published in August and updated on September 3, 2026. WinMagPro, a Dutch trade publication, reported it on September 23 and added context from the 2026 Verizon Data Breach Investigations Report and the OWASP Top 10:2025. Barracuda sells application protection products, including Web Application and API Protection (WAAP). That doesn't make the data wrong, but read the category percentages as vendor observations, not an independent census.
Barracuda's 20-vulnerability figure counts scan findings, not 20 critical bugs
Start with what the number covers. Barracuda says the findings came from customer environments scanned by Application Security Insight. WinMagPro puts the dataset at hundreds of scans. Barracuda's public post doesn't give an exact number of scans or applications, and it doesn't say how findings were rated by severity. So "20" is an average of scanner output across the customers Barracuda saw. It isn't an estimate for the web as a whole.
Barracuda is also clear that the 20 findings aren't 20 ready-made exploits. In its conclusion, the company says not every flaw is critical on its own, but that several low- and medium-risk issues can be combined to reveal sensitive information, steal credentials or gain unauthorized access. WinMagPro makes the same point: the severity and real-world exploitability of each finding vary.
A methodology note from OWASP helps put a per-application count in perspective. OWASP says it deliberately ignores how often a weakness repeats within one application when building its Top 10. Manual testers tend to list a vulnerability once, while automated frameworks log every instance separately. A scanner-based average like Barracuda's therefore depends on how the tool counts. The same underlying mistake repeated on ten pages can look like one finding or ten. That doesn't make the figure meaningless. It does mean you shouldn't compare "20" directly with figures from other vendors' tools.
The category percentages describe how the findings were spread out. They don't tell you what share of applications had each problem. When Barracuda says information disclosure is 25%, it means a quarter of all detected flaws, not a quarter of applications.
Information disclosure and brand spoofing make up half of Barracuda's findings
Barracuda sorted its findings into seven categories:
| Category (Barracuda's naming) | Share of detected flaws |
|---|---|
| Reconnaissance and information disclosure | 25% |
| Brand impersonation and spoofing | 24% |
| Client-side attacks (browser exploitation) | 14% |
| Data exposure and privacy risks | 10% |
| Network and transport security issues | 6% |
| Configuration and patch management issues | 6% |
| Session and authentication weaknesses | 5% |
Those add up to 90%, which matches Barracuda's "approximately 90%" description. The top two categories alone make up 49%, and neither is the kind of dramatic code-execution bug that gets a CVE writeup.
Information disclosure means an application or its infrastructure reveals more than it needs to about systems, domains, hidden pages, routes or services. None of that gives direct access. Its value to an attacker is reconnaissance. Barracuda says it helps attackers map an environment, find weak points and hidden admin areas, and plan targeted attacks without being noticed. The company's recommended fixes are specific: remove exposed metadata and debug information, turn off directory listings, restrict access to internal or sensitive endpoints, watch for scanning behaviour, and limit unnecessary DNS and infrastructure exposure.
Brand impersonation and spoofing covers weaknesses that make it easier to pose as an organisation's brand, website or domain and trick users into handing over credentials. Barracuda lists cloned web pages, malicious redirects, stolen logins and convincing phishing emails sent under the brand's name as possible results. It recommends enforcing the email domain-authentication standards DMARC, SPF and DKIM, using HTTPS with strict certificate validation, and deploying email security with link scanning and browser isolation.
This category shows how far "web application security" now reaches. DMARC, SPF and DKIM are DNS records managed by whoever runs the organisation's mail domain, and that is often not the team that owns the website. A scan of a customer portal that flags spoofing risk is really flagging a gap in domain governance. In many Microsoft 365 shops, that means a conversation between the web team and whoever administers Exchange Online and DNS. Barracuda's controls reduce spoofing risk. They won't stop every lookalike domain or cloned page on their own.
Cross-site scripting and data exposure put the browser and the API at risk
Client-side weaknesses make up 14% of Barracuda's findings. These are flaws in how a page displays or runs content, which let an attacker run malicious script in a visitor's browser. Cross-site scripting (XSS) is the standard example. Barracuda lists stolen session cookies, altered page content, users tricked into clicking hidden buttons (clickjacking), and misleading uploads that exploit file-type confusion.
Barracuda's advice for developers is the familiar list. Validate and encode all input. Make sure user-supplied content is treated as text, not executable code. Check that uploaded files really are the MIME type they claim to be. Add headers such as Content Security Policy (CSP) and X-Frame-Options, which restrict where content can load from and stop the site being embedded in someone else's page.
XSS keeps turning up even though the fixes are well understood. CISA and the FBI addressed this in a Secure by Design alert on September 17, 2024. They said XSS vulnerabilities are preventable and should not be present in software products, and they urged technology manufacturers' leadership to review past cases and plan to eliminate the whole class. Their recommendations cover threat-model reviews, input validation, the output-encoding features built into modern web frameworks, code review, and adversarial testing throughout development. Barracuda's post doesn't say how many of its client-side findings were actually XSS, so the 14% shouldn't be read as an XSS count.
Data exposure (10%) sounds like information disclosure but is about sensitive data, not details of the environment. Barracuda says the leaks can come through web pages, APIs, logs, cookies, tracking scripts or misconfigured responses. The data at risk includes personal information, tokens, private content, secrets, email addresses and configuration settings. Barracuda also flags a privacy angle: badly configured tracking can follow users without their consent. Its recommendations are to minimise what's exposed, review API responses and logs for leaks, apply data classification and access controls, and encrypt sensitive data in transit and at rest.
For teams building APIs, the practical point is that data can leak at the response layer even when the database is locked down. An API that returns a full user object when the front end shows only a display name is exactly this kind of finding.
TLS, patching and session cookies: 17% of the findings are basic hygiene
The last three categories together make up 17% of findings. None of them is new, which is why they're worth looking at.
Network and transport issues (6%) are weak or missing encryption that lets traffic be intercepted or altered. Barracuda mentions credentials and session tokens stolen through adversary-in-the-middle (AiTM) attacks and DNS manipulation. The fixes are HTTPS everywhere, HTTP Strict Transport Security (HSTS) so browsers always connect over HTTPS, removing mixed content such as images loaded over plain HTTP, modern TLS with valid certificates, and DNSSEC where appropriate.
Configuration and patch management (6%) covers outdated software and insecure settings that let attackers use public exploit code, automated scanners or known techniques. Barracuda recommends a committed patching process, continuous vulnerability scanning, hardened configurations, removing obsolete software, and tracking known-exploited vulnerabilities.
Session and authentication weaknesses (5%) are gaps in how sessions, cookies and credentials are protected, which lead to account takeover, persistent access or bypassed login controls. Barracuda recommends the Secure, HttpOnly and SameSite cookie flags, shorter session lifetimes, token rotation, re-authentication before sensitive actions, and consistently enforced multifactor authentication. Barracuda's wording could suggest the three cookie flags are alternatives, but they do different jobs. As WinMagPro explains, Secure sends the cookie only over encrypted connections, HttpOnly blocks scripts from reading it, and SameSite limits when it's sent with cross-site requests. HttpOnly directly limits the cookie theft that XSS makes possible, so the client-side and session categories overlap in practice.
Configuration and patching get only 6% in Barracuda's scans, but they sit higher in wider industry data. In the OWASP Top 10:2025, Security Misconfiguration moved from fifth place in 2021 to second. OWASP says 3.00% of applications tested had at least one of the 16 weaknesses in that category, and it links the rise to more application behaviour being driven by configuration. Third place went to Software Supply Chain Failures, an expanded version of the 2021 "Vulnerable and Outdated Components" category that now includes dependencies, build systems and distribution infrastructure. OWASP notes that this category appears less often in its data but has the highest average exploit and impact scores from CVEs. Its categories and Barracuda's are separate taxonomies built on different data, so they shouldn't be merged. Both still point to configuration and dependencies as places where risk builds up.
Verizon's 2026 DBIR shows why unfixed web flaws matter
The Verizon DBIR puts Barracuda's findings in context. It doesn't validate Barracuda's per-application average; it measures actual breaches. Verizon's analysts reviewed more than 31,000 security incidents and over 22,000 confirmed breaches across 145 countries for this edition, covering the twelve months from November 1, 2024 through October 31, 2025. In that dataset, exploitation of vulnerabilities now accounts for 31% of initial access methods, while credential abuse has dropped to 13%. That is up from 20% the year before and the first time exploitation has led in the report's history.
The headline comparison needs one qualification. Push Security's analysis points out that this year's report added pretexting as a new initial access category, and without that change, credential abuse would have been 16% rather than 13%. Identity-based attacks haven't gone away. Exploitation grew fast enough to overtake them.
Remediation speed is the more pointed finding for anyone with a backlog of web findings. Only 26% of CISA's Known Exploited Vulnerabilities were fully remediated in 2025, down from 38% the year before. Median remediation time stretched from 32 days to 43 days. Put that next to Barracuda's average of 20 findings per application. The individual items may be minor, but if the backlog is fixed at that pace, several of them will stay open long enough for an attacker to chain together.
WinMagPro gives an example of such a chain. An information leak exposes a hidden endpoint. That endpoint turns out to run a misconfigured or outdated component. A session or browser-side weakness then provides the next step. None of the three gives full control on its own, but together they can get an attacker in. It's an illustration, not a documented incident, but it matches Barracuda's warning about combining low- and medium-risk flaws.
What web application owners should do about the Barracuda findings
The decision for most teams is whether to keep triaging web findings purely by severity label. If your scanner results are sorted by CVSS score and anything rated "low" or "medium" waits indefinitely, Barracuda's data is a reason to change that. Cheap fixes in the reconnaissance and data-exposure categories remove exactly the information an attacker needs to find a path to the serious flaws.
Barracuda's own advice is to scan continuously for vulnerabilities and misconfigurations, not once per release, and to patch applications, frameworks and dependencies quickly. WinMagPro adds that detection only helps if someone acts on it. OWASP renamed its ninth category Security Logging & Alerting Failures to stress that point, saying great logging with no alerting is of minimal value.
- Treat information disclosure and data exposure as quick wins. Remove debug output, verbose error messages, directory listings and unnecessary metadata, and check API responses for fields the client never uses.
- Check that DMARC, SPF and DKIM are enforced on every domain tied to a public web application, because Barracuda counts spoofing exposure as nearly a quarter of its findings.
- Set Secure, HttpOnly and SameSite on session cookies together, shorten session lifetimes, and require re-authentication and MFA for sensitive actions.
- Deploy HSTS and CSP headers, remove mixed content, and use your web framework's built-in output encoding in line with the CISA and FBI guidance on XSS.
- Keep an inventory of direct and transitive dependencies, and add a service-level target for fixing known-exploited vulnerabilities, given Verizon's 43-day median.
- Prioritise findings by exposure, data sensitivity and whether they can be chained, not just by the individual severity score or how many there are.
Barracuda's figures come from a vendor scanning its own customers, and its exact sample size isn't public. Even so, the pattern matches what OWASP's larger dataset and Verizon's breach analysis show. Most of the weaknesses on the web right now are routine, known and fixable. Attackers are increasingly getting in through exploited flaws, and organisations took longer to patch in 2025 than the year before. The teams that clear the unglamorous 90% of findings on a regular schedule will give attackers far fewer steps to chain together.