CVE-2023-2868

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 14 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

89.98%

probability

This CVE has a 89.98% probability of being exploited in the next 30 days.

0% Top 99.6th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

Remote command injection due to incomplete input validation

Attack Intelligence

CWE-20 · Improper Input Validation CWE-707 · Improper Neutralization CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-77 · Command Injection

Google Project Zero

Discovered

May 18, 2023

Patched

May 30, 2023

Reported by

???

Root Cause Analysis

???

Exploits & PoC

cfielding-r7/poc-cve-2023-2868

PoC CVE-2023-2868 — cfielding-r7/poc-cve-2023-2868

1 repo — triés par ⭐ Rechercher sur GitHub ↗

2023 Threat Landscape Year in Review: If Everything Is Critical, Nothing Is

Qualys Dec 19, 2023

CISA warns govt agencies of recently patched Barracuda zero-day

BleepingComputer May 27, 2023

FBI warns of patched Barracuda ESG appliances still being hacked

BleepingComputer Aug 24, 2023

Barracuda fixes new ESG zero-day exploited by Chinese hackers

BleepingComputer Dec 27, 2023

Alert: Hackers Exploit Barracuda Email Security Gateway 0-Day Flaw for 7 Months

TheHackerNews

Barracuda Warns of Zero-Day Exploited to Breach Email Security Gateway Appliances

TheHackerNews

Chinese Hackers Exploited New Zero-Day in Barracuda's ESG Appliances

TheHackerNews

US govt email servers hacked in Barracuda zero-day attacks

BleepingComputer Aug 29, 2023

Barracuda zero-day abused since 2022 to drop new malware, steal data

BleepingComputer May 30, 2023

Barracuda warns of email gateways breached via zero-day flaw

BleepingComputer May 24, 2023

Hackers Deploy "SUBMARINE" Backdoor in Barracuda Email Security Gateway Attacks

TheHackerNews

Barracuda Urges Immediate Replacement of Hacked ESG Appliances

TheHackerNews

Urgent FBI Warning: Barracuda Email Gateways Vulnerable Despite Recent Patches

TheHackerNews

Barracuda ESG zero-day attacks linked to suspected Chinese hackers

BleepingComputer Jun 15, 2023

Signal Intelligence

Confidenceⓘ

92%

EPSS 89.98%

Mentions 14

Last Seen Dec 27, 2023

CNA Information

Analyst Note

This CVE is confirmed as a zero-day exploited in active attacks by Chinese threat actors against Barracuda Email Security Gateway appliances. The critical CVSS 9.4 score, inclusion in Google Project Zero, and reporting by reputable security outlets (BleepingComputer) corroborate the vulnerability's existence and severity.