Barracuda Email Security Gateway Zero-Day Remote Command Injection
A remote command-injection vulnerability in Barracuda Email Security Gateway (ESG) appliances, exploited as a zero-day for at least seven months before discovery, allowed attackers to gain a persistent backdoor — remediation required full physical appliance replacement, not just a patch, in confirmed-compromised units.
- Vendor
- Barracuda
- Product
- Email Security Gateway
- CVSS
- 9.8
- EPSS (exploit probability)
- 86.8%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2023-2868 being exploited?
Yes. CISA added CVE-2023-2868 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 86.8% (scored October 18, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-23. Full cross-catalog view: /kev-comparison
CVE-2023-2868 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (21 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2023-2868 is a remote command-injection vulnerability in Barracuda Networks’ Email Security Gateway (ESG) appliances, arising from incomplete input validation in a module that screens attachments. Barracuda disclosed it on May 23, 2023, after finding evidence that the flaw had been actively exploited since at least October 2022 — roughly seven months of undetected zero-day exploitation targeting a subset of ESG appliances.
Why it mattered
The attackers used their access to deploy custom malware for persistence and data exfiltration, and — unusually — Barracuda’s investigation determined that some compromised appliances remained backdoored even after the software patch was applied, because the malware had established persistence mechanisms the patch didn’t remove. Barracuda made the unusual call to tell affected customers to fully replace compromised physical appliances rather than trust a software fix alone, a remediation step rarely seen outside of firmware-level implants.
CISA and threat intelligence researchers linked the campaign to a China-nexus espionage actor targeting a relatively small number of government and high-value targets, distinguishing this from the mass-exploitation pattern seen with many other perimeter-device CVEs. The vulnerability was added to CISA’s KEV catalog. Full detail on the incident and remediation guidance is in Barracuda’s security advisory and at the NVD link above.
