Vendor

Barracuda Networks

Vulnerabilities in Barracuda Networks' Email Security Gateway appliances — internet-facing mail-scanning devices that, once compromised, gave attackers a foothold that in one case survived even after patching.

1 CVEs1 articlesRSS

CVEs

CVE-2023-2868

[ CRITICAL ]CVSS 9.8EPSS 87.4%kev

Barracuda Email Security Gateway Zero-Day Remote Command Injection

A remote command-injection vulnerability in Barracuda Email Security Gateway (ESG) appliances, exploited as a zero-day for at least seven months before discovery, allowed attackers to gain a persistent backdoor — remediation required full physical appliance replacement, not just a patch, in confirmed-compromised units.

Barracuda / Email Security GatewayMay 23, 2023

Articles

~/articles/2026-07-05-barracuda-esg-zero-day-cve-2023-2868

Analysis

barracuda

Barracuda Told Customers to Replace ESG Appliances

CVE-2023-2868 was exploited as a zero-day for roughly seven months before discovery — and left some compromised appliances backdoored even after the software patch was applied.

Jul 5read →