[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKoc15r18ofgbZR26_iXgccDw3CfoEhrP29HW85k_fTs":3,"g5a-family:barracuda\u002Femail_security_gateway_600":80,"g5a-ex:barracuda\u002Femail_security_gateway_600@*":83},{"success":4,"data":5},true,{"product":6,"versions":15,"topVulnerabilitiesByEpss":16,"kevVulnerabilities":44,"seoMetadata":58,"meta":77},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":14},"barracuda","email_security_gateway_600",0,2,1,"2023-12-24",[],"Email Security Gateway 600 by Barracuda is a technology product and 2 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[],[17,25,31,38],{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":24},"CVE-2023-2868","A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.","2023-05-24",9.4,"v3.1","Critical",0.86841,{"cveId":26,"description":27,"publishedDate":12,"cvssScore":28,"cvssVersion":22,"severity":23,"isKev":29,"epssScore":30},"CVE-2023-7102","Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.\n\n",9.8,false,0.44575,{"cveId":32,"description":33,"publishedDate":34,"cvssScore":35,"cvssVersion":36,"severity":23,"isKev":4,"epssScore":37},"CVE-2026-116606","An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.","2026-11-02",9.3,"v4.0",0.10947,{"cveId":39,"description":40,"publishedDate":34,"cvssScore":41,"cvssVersion":36,"severity":42,"isKev":4,"epssScore":43},"CVE-2026-111560","Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.",8.6,"High",0.09082,[45,50,53],{"cveId":39,"description":40,"publishedDate":34,"cvssScore":41,"severity":42,"isKev":4,"epssScore":43,"cisaVulnName":46,"cisaDateAdded":47,"cisaShortDescription":48,"cisaRequiredAction":49},"Barracuda Networks Multiple Products OS Command Injection Vulnerability","2026-11-10","Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",{"cveId":32,"description":33,"publishedDate":34,"cvssScore":35,"severity":23,"isKev":4,"epssScore":37,"cisaVulnName":51,"cisaDateAdded":47,"cisaShortDescription":52,"cisaRequiredAction":49},"Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability","Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.",{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"severity":23,"isKev":4,"epssScore":24,"cisaVulnName":54,"cisaDateAdded":55,"cisaShortDescription":56,"cisaRequiredAction":57},"Barracuda Networks ESG Appliance Improper Input Validation Vulnerability","2023-05-26","Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.","Apply updates per vendor instructions.",{"title":59,"metaDescription":60,"keywords":61,"structuredData":62},"Email Security Gateway 600 by Barracuda - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Email Security Gateway 600 by Barracuda with 2 tracked vulnerabilities including 2 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Email Security Gateway 600 vulnerabilities, Email Security Gateway 600 security, Email Security Gateway 600 CVE, Barracuda Email Security Gateway 600, Email Security Gateway 600 threat intelligence, Barracuda security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Email Security Gateway 600 KEV, Email Security Gateway 600 exploited vulnerabilities",{"@context":63,"@type":64,"name":65,"description":60,"url":66,"manufacturer":67,"applicationCategory":71,"softwareVersion":72,"mainEntity":73},"https:\u002F\u002Fschema.org","SoftwareApplication","Email Security Gateway 600","https:\u002F\u002Fedgeprotect.io\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fbarracuda\u002Femail_security_gateway_600",{"@type":68,"name":69,"url":70},"Organization","Barracuda","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fbarracuda","Security Software","Multiple versions",{"@type":74,"name":75,"description":76,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Email Security Gateway 600 Security Vulnerabilities","Security vulnerabilities affecting Email Security Gateway 600 by Barracuda",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":78,"apiVersion":79},"2026-11-14T05:15:23.449Z","3.0",[81],{"product":82,"cves":10},"email_security_gateway_600_firmware",{"rows":84,"total":97,"capped":29,"failed":9},[85,89,93],{"cveId":39,"name":46,"severity":42,"cvss":41,"added":47,"epss":43,"published":86,"ranges":87,"checked":4,"hits":88,"covers":29},"2026-11-02T13:17:35.19",[],[],{"cveId":32,"name":51,"severity":23,"cvss":35,"added":47,"epss":37,"published":90,"ranges":91,"checked":4,"hits":92,"covers":29},"2026-11-02T13:17:37.017",[],[],{"cveId":18,"name":54,"severity":23,"cvss":21,"added":55,"epss":24,"published":94,"ranges":95,"checked":4,"hits":96,"covers":29},"2023-05-24T19:15:09.363",[],[],3]