The Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical vulnerability affecting Barracuda Networks devices to their Known Exploited Vulnerabilities (KEV) catalog, mandating that all Federal Civilian Executive Branch (FCEB) agencies apply the update by no later than June 16, 2023. The flaw, tracked as CVE-2023-2868, is an improper input validation bug in Barracuda Networks’ Email Security Gateway (ESG) appliances, stemming from a failure to properly sanitize .tar file archives. A threat actor could exploit this vulnerability by providing a maliciously crafted .tar file to conduct remote code execution (RCE) with the privileges of the ESG product. Barracuda Networks is a very popular company and serves more than 200,000 customers across the world. The CISA advisory states that these types of vulnerabilities “are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.” Barracuda Networks has stated that any users who they believe were impacted by the exploitation of this vulnerability have been notified and given actions to take to mitigate the damage. Barracuda Networks sent out automatic patches on May 20 and 21, and CTIX analysts recommend that any administrators responsible for these devices ensure that they’ve been patched.