Skip to content

CVE-2023-2868 · CVE record: PUBLISHED

Remote Code injection in Barracuda Email Security Gateway

Barracuda Barracuda Email Security Gateway

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

Exploitation evidence

Known exploited · CISA KEV listed

Added 2023-05-26. Ransomware campaign use: Unknown.

CISA required action: Apply updates per vendor instructions.

CISA due date: 2023-06-16. This is the catalog’s deadline, not an assessment of your organization’s exposure.

KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗

Reported products and versions

Barracuda / Barracuda Email Security Gateway

Default status: unaffected

affected: 5.1.3.001 to < 9.2.0.006 (custom)

Fixes and workarounds

No explicit solution text in the downloaded CVE record. Consult the vendor advisory; unaffected version ranges are shown above as reported, not inferred as a patch recommendation.

Sources and related reporting

CVE Program record ↗ · Download tracked evidence as JSON

Monitored source mentions

BleepingComputer — Hackers now exploit critical Barracuda ESG flaws to gain root access ↗

Shared CVE identifiers link source mentions; they do not establish that the reports describe the same incident.

Observed change timeline

History begins when Egret first downloads each source. It is not the complete upstream CVE history.

12 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-12",
  "epss": 0.86841,
  "percentile": 0.99749
}

10 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-10",
  "epss": 0.86841,
  "percentile": 0.99748
}

09 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-09",
  "epss": 0.86841,
  "percentile": 0.99747
}

08 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-08",
  "epss": 0.86841,
  "percentile": 0.99747
}

07 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-07",
  "epss": 0.86841,
  "percentile": 0.99747
}

06 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-06",
  "epss": 0.86841,
  "percentile": 0.99747
}

06 Nov 2026, 06:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-05",
  "epss": 0.86841,
  "percentile": 0.99746
}

04 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-04",
  "epss": 0.86841,
  "percentile": 0.99746
}

04 Nov 2026, 18:20 Jerusalem · CVE Program record changed

Stored CNA snapshot at this observation.

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:33:06.053Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.barracuda.com/company/legal/esg-vulnerability"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://status.barracuda.com/incidents/34kx82j5n4q9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-2868",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-16T15:36:08.898946Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-05-26",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:05:47.195Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2023-05-26T00:00:00.000Z",
            "value": "CVE-2023-2868 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Barracuda Email Security Gateway",
          "vendor": "Barracuda",
          "versions": [
            {
              "lessThan": "9.2.0.006",
              "status": "affected",
              "version": "5.1.3.001",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-05-23T10:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives).&nbsp;The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product.&nbsp;This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances."
            }
          ],
          "value": "A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-253",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-253 Remote Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-24T18:00:52.360Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://www.barracuda.com/company/legal/esg-vulnerability"
        },
        {
          "url": "https://status.barracuda.com/incidents/34kx82j5n4q9"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Remote Code injection in Barracuda Email Security Gateway",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2023-2868",
    "datePublished": "2023-05-24T18:00:52.360Z",
    "dateReserved": "2023-05-24T14:24:16.482Z",
    "dateUpdated": "2025-10-21T23:05:47.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

03 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-03",
  "epss": 0.86841,
  "percentile": 0.99745
}

03 Nov 2026, 02:22 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-02",
  "epss": 0.86841,
  "percentile": 0.99744
}

03 Nov 2026, 02:22 Jerusalem · CISA KEV status changed

Stored KEV snapshot at this observation.

{
  "cveID": "CVE-2023-2868",
  "cwes": [
    "CWE-20"
  ],
  "dateAdded": "2023-05-26",
  "dueDate": "2023-06-16",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://status.barracuda.com/incidents/34kx82j5n4q9;  https://nvd.nist.gov/vuln/detail/CVE-2023-2868",
  "product": "Email Security Gateway (ESG) Appliance",
  "requiredAction": "Apply updates per vendor instructions.",
  "shortDescription": "Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.",
  "vendorProject": "Barracuda Networks",
  "vulnerabilityName": "Barracuda Networks ESG Appliance Improper Input Validation Vulnerability"
}

Egret — Back to top Egret