CVE-2023-2868

Barracuda Networks ESG Appliance Improper Input Validation Vulnerability

Barracuda Networks — Email Security Gateway (ESG) Appliance

Added to KEV catalog: 26 May 2023
Federal remediation due date: 16 June 2023
Weakness classification (CWE): CWE-20

CISA Description

Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.

Required action

Apply updates per vendor instructions.

Notes

https://status.barracuda.com/incidents/34kx82j5n4q9; https://nvd.nist.gov/vuln/detail/CVE-2023-2868

View on NVD View on MITRE CVE View full CISA catalog

More Barracuda Networks Vulnerabilities

CVE-2026-111560

Barracuda Networks Multiple Products OS Command Injection Vulnerability

CVE-2026-116606

Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services