Skip to main content
View

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
Impact

CVSS score of 9.8 (CRITICAL). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required.
Exploit ScenarioDerived

This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the critical-severity affected system.
Emergency Immediate action required. Why: CRITICAL + in CISA KEV (actively exploited), no patch available.
Exploited in the wild (CISA KEV) No patch listed yet 87.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-20. A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances. Affected products include: Barracuda Email Security Gateway 300 Firmware, Barracuda Email Security Gateway 400 Firmware, Barracuda Email Security Gateway 600 Firmware, Barracuda Email Security Gateway 800 Firmware, Barracuda Email Security Gateway 900 Firmware.

Know when Barracuda gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Added to CISA KEV
Jul 14, 2026 - 04:22 CISA
CVE Published
May 24, 2023 - 19:15 nvd
CRITICAL 9.8

DescriptionNVD

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

Threat Intelligence Overview

EPSS Score
87.0%
Top 0% exploitable
Exploit
POC
Public exploit code exists
Data Quality
3 sources
Confidence: Low
NVD CVE.org CISA KEV EPSS POC (1)

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV Yes
Public POC Yes
EPSS 87.0%
Patch available No
Active threat Yes
Deciding rule
CRITICAL + in CISA KEV (actively exploited), no patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Immediate
Exploitation· derived
Active
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact· derived
High

Priority Score

221
Low Medium High Critical
KEV: +50
EPSS: +87
CVSS: +49
PoC: +20
Weaponized: +15
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Affected Products (CPE)NVD

cpe:2.3:o:barracuda:email_security_gateway_300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:barracuda:email_security_gateway_400_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:barracuda:email_security_gateway_600_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:barracuda:email_security_gateway_800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:barracuda:email_security_gateway_900_firmware:*:*:*:*:*:*:*:*

More in Barracuda

View all
CVE-2025-34392 CRITICAL POC
10.0 Dec 10

Unauthenticated remote code execution in the Barracuda RMM Service Center component (part of the RMM managed-service-pro
CVE-2017-6320 HIGH POC
8.8 Jul 18

A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (20
CVE-2023-7102 CRITICAL POC
9.8 Dec 24

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Rated critical severity (CVSS 9.8), thi
CVE-2019-6724 HIGH POC
7.8 Mar 21

The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a

CVE-2023-26213 HIGH POC
7.2 Mar 03

On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injectio
CVE-2025-34394 CRITICAL
10.0 Dec 10

Unauthenticated remote code execution affects the Barracuda Service Center component of Barracuda RMM in all versions pr
CVE-2025-34393 CRITICAL
10.0 Dec 10

Remote code execution in Barracuda RMM's Service Center component (versions prior to 2025.1.1) allows unauthenticated ne
CVE-2018-20369 MEDIUM POC
6.1 Dec 23

Barracuda Message Archiver 2018 has XSS in the error_msg exception-handling value for the ldap_user parameter to the cgi
CVE-2014-8428 CRITICAL
9.8 Aug 28

Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an improperly protected SSH key.

CVE-2014-8426 CRITICAL
9.8 Aug 28

Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015. Rated critical severity (CVSS 9.8), this vulnerability
CVE-2025-34395 HIGH
8.7 Dec 10

Unauthenticated remote attackers can read arbitrary files from Barracuda RMM versions prior to 2025.1.1 by invoking a pa
CVE-2026-22676 HIGH
8.5 Apr 15

Local privilege escalation in Barracuda RMM (all versions prior to 2025.2.2) enables authenticated Windows users to exec

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2016-3081 HIGH POC
8.1
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY https://status.barracuda.com/incidents/34kx82j5n4q9 ADVISORY https://www.barracuda.com/company/legal/esg-vulnerability REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy