VulnRadar

Data against noise.

Page generated: 08 Nov 2026, 14:45 UTC

CVE-2023-2868

Read full description

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

CVSS 9.4 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

1.6/10

REALITY · THREAT PRIORITY

8.8/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 9.4: +1.41
Fresh EPSS: 86.84%: +0.43

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 15 documents and public datasets.

Hype components

Headline sample (25%)

50/100

Press, 30 days (60%)

5/100

Grounded branding (15%)

0/100

HYPE TOTAL16/100

Sources and documents

watchTowr Labs

Press · 05 Nov 2026, 21:19 · Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)

Google Cloud

Press · 29 Aug 2023, 07:00 · Diving Deep into UNC4841 Operations Following Barracuda ESG Zero-Day Remediation (CVE-2023-2868) | Mandiant - Google Cloud

TechTarget

Press · 31 Jul 2023, 07:00 · CISA details backdoor malware used in Barracuda ESG attacks - TechTarget

TechTarget

Press · 31 Jul 2023, 07:00 · CISA details backdoor malware used in Barracuda ESG attacks - TechTarget

The Hacker News

Press · 29 Jul 2023, 07:00 · Hackers Deploy "SUBMARINE" Backdoor in Barracuda Email Security Gateway Attacks - The Hacker News

See all 15 source documents

Industrial Cyber

Press · 19 Jul 2023, 07:00 · Mandiant details Chinese cyber espionage hackers evolve stealth tactics to avoid detection - Industrial Cyber

BleepingComputer

Press · 15 Jun 2023, 07:00 · Barracuda ESG zero-day attacks linked to suspected Chinese hackers - BleepingComputer

Google Cloud

Press · 15 Jun 2023, 07:00 · Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor, Suspected Links to China - Google Cloud

Arctic Wolf

Press · 09 Jun 2023, 07:00 · Recommendation for CVE 2023-2868 - Arctic Wolf

Rapid7

Press · 08 Jun 2023, 07:00 · CVE-2023-2868: Total Compromise of Physical Barracuda ESG Appliances - Rapid7

The Hacker News

Press · 08 Jun 2023, 07:00 · Barracuda Urges Immediate Replacement of Hacked ESG Appliances - The Hacker News

SecurityWeek

Press · 31 May 2023, 07:00 · Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery - SecurityWeek

BleepingComputer

Press · 30 May 2023, 07:00 · Barracuda zero-day abused since 2022 to drop new malware, steal data - BleepingComputer

Help Net Security

Press · 30 May 2023, 07:00 · Attackers hacked Barracuda ESG appliances via zero-day since October 2022 - Help Net Security

Cybersecurity Dive

Press · 25 May 2023, 07:00 · Barracuda patches actively exploited zero-day vulnerability in email gateways - Cybersecurity Dive

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

━ Hype Score (Perceived) ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

Public exploit entries / repo candidates

See 2 repos with metrics

Repository	Stars	Forks	Language	Updated
getdrive/PoC	73	15	Ruby	12 Aug 2024, 07:34
cfielding-r7/poc-cve-2023-2868	11	6	Ruby	05 Jul 2023, 20:02

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 9.4; EPSS 86.8%
Attention, last 30 days: 1 distinct story titles; 1 press documents; 1 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-06 07:51:05.081558+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

24 May 2023, 18:00

First press mention

25 May 2023, 07:00

Added to the CISA KEV catalog

26 May 2023, 00:00

Latest press mention

05 Nov 2026, 21:19

Score calculated

06 Nov 2026, 07:51

PoCs on GitHub

2 repositories