ACTIVELY EXPLOITED
CVE-2023-2868: Barracuda Networks ESG Appliance Improper Input Validation Vulnerability
| Vendor | Barracuda Networks |
|---|---|
| Product | Email Security Gateway (ESG) Appliance |
| Actively exploited | Yes |
| Added to CISA KEV | 26 May 2023 |
| CISA federal deadline | 16 Jun 2023 |
| Weakness (CWE) | CWE-20 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.
SOURCES
Other Barracuda Networks flaws
- CVE-2026-116606: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-111560: Barracuda Networks Multiple Products OS Command Injection Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.