Barracuda finds average web app has 20 security flaws

Barracuda has published research showing that the average web application has 20 security vulnerabilities, with most flaws stemming from basic misconfigurations and oversights.

The findings are based on an analysis of hundreds of Application Security Insight scans conducted over five months in 2026. Researchers identified seven main categories of weakness that accounted for about 90% of all detected vulnerabilities.

Information disclosure was the most common issue, representing 25% of the flaws found. These weaknesses can reveal details about systems, domains, hidden pages, routes, or services, giving attackers information they can use to map a target environment and identify weak points.

Brand impersonation and spoofing made up 23% of detected flaws. These weaknesses can make it easier for attackers to mimic a trusted brand, website, or domain to deceive users into sharing credentials or other sensitive information.

Client-side attacks, including browser-based exploits such as cross-site scripting, accounted for 14% of identified flaws. According to the research, these weaknesses can allow attackers to run malicious scripts in a user's browser, steal session cookies, alter visible content, or manipulate user actions.

Data exposure represented 10% of the vulnerabilities found. This can arise when sensitive information is exposed through webpages, application programming interfaces, logs, cookies, tracking scripts, or misconfigured responses.

Other categories included weak or missing encryption, which accounted for 6% of flaws; outdated software or insecure configurations, also at 6%; and weaknesses in session management and the protection of cookies and credentials, at 5%.

Common weaknesses

The breakdown suggests that many web application issues are not highly specialised flaws but routine security gaps. Missteps in configuration, patching, information handling, and session protection appeared repeatedly across the scan results.

Web applications remain a common target because they sit at the point where organisations interact with customers, partners, and internal users. Weaknesses in these systems can expose data, compromise accounts, or open paths into wider corporate environments.

Jesus Cordero-Guzman, Director, Solution Architects AppSec, NetSec & XDR International, Barracuda, said web applications have become central to day-to-day business activity.

"Web applications are a critical interface for organisations - from website storefronts to interactive interfaces for customers, partners and operations. Keeping them secure is essential," said Jesus Cordero-Guzman, Director, Solution Architects AppSec, NetSec & XDR International, Barracuda.

He said the number of vulnerabilities found in the average application gives attackers multiple openings rather than a single point of failure.

"An average of 20 vulnerabilities per application means attackers have multiple opportunities to probe, test and exploit weaknesses. While not every issue is critical on its own, attackers often chain together several low- and medium-risk vulnerabilities to expose sensitive information, steal credentials or gain unauthorised access. Organisations need a proactive, layered approach to application security that continuously identifies and addresses risks before they can be exploited," Cordero-Guzman said.

Risk reduction

Barracuda recommended that organisations regularly scan web applications for vulnerabilities and security misconfigurations, patch applications, frameworks, and dependencies promptly, reduce unnecessary information disclosure, tighten encryption, authentication, and session controls, and monitor applications for suspicious activity and emerging threats.

The figures add to wider concerns about the persistence of basic web security problems even as companies spend more on cyber defences. The prevalence of information disclosure, spoofing risks, and client-side weaknesses indicates that many applications still give attackers multiple usable entry points rather than presenting isolated defects.

Overall, the research found that seven categories alone accounted for roughly 90% of all detected vulnerabilities.