Vendor

Barracuda Networks

Vulnerabilities in Barracuda Networks' Email Security Gateway appliances — internet-facing mail-scanning devices that, once compromised, gave attackers a foothold that in one case survived even after patching.

CVEs

CVE-2023-2868

[ CRITICAL ] CVSS 9.8 kev

Barracuda Email Security Gateway Zero-Day Remote Command Injection

A remote command-injection vulnerability in Barracuda Email Security Gateway (ESG) appliances, exploited as a zero-day for at least seven months before discovery, allowed attackers to gain a persistent backdoor — remediation required full physical appliance replacement, not just a patch, in confirmed-compromised units.

Barracuda / Email Security Gateway May 23, 2023

Articles

~/articles/2026-07-05-barracuda-esg-zero-day-cve-2023-2868

Analysis

barracuda

Barracuda Told Customers to Replace Their Appliances, Not Just Patch Them. Here's Why.

CVE-2023-2868 was exploited as a zero-day for roughly seven months before discovery — and left some compromised appliances backdoored even after the software patch was applied.

Jul 5 read →