CVE-2023-2868: Barracuda Email Security Gateway tar filename command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 pre-auth remote command injection on a perimeter appliance, listed in CISA KEV with a 0.877 EPSS probability, makes this an urgent patching priority.

What it is

The Barracuda Email Security Gateway appliance fails to properly validate filenames inside user-supplied .tar archives, allowing a remote attacker to inject and execute system commands via Perl's qx operator. The flaw affects versions 5.1.3.001 through 9.2.0.006 and was fixed in patch BNSF-36456, which was automatically applied to customer appliances. Because it is remotely reachable without authentication, it is a serious pre-auth compromise path for a perimeter email security device.

Impact

An attacker can execute arbitrary system commands with the privileges of the Email Security Gateway product, giving full control of the appliance and a foothold on the network edge. This can lead to data theft, persistent access, and use of the appliance as a pivot point.

Attack surface

The vulnerability is network-reachable (AV:N) with no privileges or user interaction required (PR:N, UI:N), reached by sending a crafted .tar archive to the affected appliance. No authentication is needed per the CVSS vector.

Exploitation

CVE-2023-2868 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-05-26) and has a very high EPSS 30-day probability of 0.87691 (99.75th percentile), indicating active exploitation is expected or observed. No ransomware campaign use is documented in the record.

What to do

• Apply the vendor patch BNSF-36456 immediately; Barracuda states it was automatically applied to all customer appliances, so verify the appliance is running a fixed version.
• If the appliance cannot be confirmed patched, isolate or replace it per Barracuda's ESG vulnerability guidance.
• Restrict management and mail-processing exposure of the ESG appliance to only required networks.
• Monitor Barracuda status and vendor advisories for follow-up guidance and any required credential rotation.
• Review the appliance for signs of prior compromise before returning it to production.

Detection

• Inspect ESG appliance logs for unexpected command execution or Perl qx activity tied to tar archive processing.
• Alert on anomalous outbound connections or new processes originating from the Email Security Gateway appliance.
• Monitor for unusual .tar archive handling or filename patterns containing shell metacharacters reaching the appliance.
• Correlate appliance activity with CISA KEV guidance and hunt for indicators of post-exploitation persistence on the device.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.