CVE-2023-2868: Remote Code injection in Barracuda Email Security Gateway

Analysis on rafaelpfister.ch

Article · November 11, 2026 CVE-2026-116606: Barracuda ESG Authentication Bypass Is Being Exploited - Update and Check for Compromise An authentication bypass in Barracuda Email Security Gateway before 9.4.0.030 (CVE-2026-116606, CVSS 4.0: 9.3) allows a crafted configuration backup to be imported without logging in. Barracuda confirms attacks, and CISA has listed the vulnerability in its KEV Catalog since November 10, 2026. Patches have been available since November 2; the management interface should not be accessible from the internet.

Vendor description

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

Reference data

Vendor

Barracuda

Affected products

Barracuda Email Security Gateway

CVSS 3.1

9.4 (CRITICAL)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness type

CWE-20: Improper Input Validation

Published

May 24, 2023

In KEV catalog since

May 26, 2023

US federal deadline

June 16, 2023

Official sources

← All vulnerabilities