← Back to Vulnerability Reports CVE Intelligence

CVE-2023-7102

Barracuda Email Security Gateway•CRITICAL · CVSS 9.8•No exploitation reported

What is CVE-2023-7102?

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.

CVSS9.8 NVD 3.1
SeverityCRITICAL
ExploitationNo exploitation reported
EPSS45% · P99
Triage statusNo Known Exploit
ActionPatch within 48 hours
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWECWE-1104
NVD published2023-12-24
NVD last modified2026-06-17

Timeline

  • 2023-12-24Published to the U.S. National Vulnerability Database (NVD)
  • 2026-06-17NVD record last updated
  • 2026-11-04First covered in a defend.network daily briefing

Affected product

Barracuda Email Security Gateway

NVD also lists CPE entries for: Barracuda Email Security Gateway 300 Firmware, Barracuda Email Security Gateway 300, Barracuda Email Security Gateway 400 Firmware, Barracuda Email Security Gateway 400, Barracuda Email Security Gateway 600 Firmware

Remediation Steps

  1. Apply the vendor security update for Barracuda Email Security Gateway as a priority.
  2. Restrict network exposure of the affected service to trusted sources until patched.
  3. Review logs and detections for indicators of exploitation.
  4. Confirm fixed versions against the official vendor advisory before deploying.

References

Referenced in our briefings & reports

Related vulnerabilities

  • CVE-2023-2868 – Barracuda Networks Email Security Gateway (ESG) Appliance (same product)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.