Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The 2023 Barracuda Email Security Gateway incident involved CVE-2023-2868, a remote command-injection vulnerability in ESG appliances. Barracuda said attackers had exploited it as early as October 2022; the company patched ESG appliances in May 2023, but advised customers whose appliances it identified as compromised to replace them regardless of patch level.
What is CVE-2023-2868?
CVE-2023-2868 was a remote command-injection flaw in the Barracuda Email Security Gateway (ESG) appliance. Barracuda said incomplete validation of user-supplied .tar attachments could allow a remote attacker to execute a system command with the privileges of the ESG product. The vulnerable code was in the module that initially screened incoming email attachments. CISA likewise described the issue as improper input validation of a user-supplied .tar file leading to remote command injection. Barracuda’s advisory and CISA’s alert provide the technical summary.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Barracuda Networks Spam & Virus Firewall 200 | Buy on Amazon |
Was Barracuda ESG hacked?
Yes. Barracuda said the vulnerability was used to gain unauthorized access to a subset of ESG appliances. It identified malware that provided persistent backdoor access and evidence of data exfiltration on a subset of impacted appliances. That does not mean every appliance in the vulnerable version range was compromised.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Barracuda identified the vulnerability on May 19, 2023, and said it applied a security patch to ESG appliances worldwide on May 20, followed by a second patch on May 21 as part of containment. In its May 30 advisory, Barracuda reported that the earliest identified evidence of exploitation was October 2022—months before the issue was publicly disclosed. The sources describe a subset or limited number of impacted appliances, but do not establish a precise count of compromised devices or organizations. Barracuda’s incident updates give its account of the response and impact.
#1 Best Overall
Who was behind the activity?
Mandiant tracked the activity as UNC4841 and assessed with high confidence that the actor conducted targeted information gathering in support of the People’s Republic of China. Mandiant characterized the activity as espionage and recommended that affected organizations investigate their networks and hunt for the actor. This is Mandiant’s assessment, not a claim that Barracuda attributed to every affected organization. Mandiant’s analysis describes the actor and its recommendation.
Which Barracuda ESG versions were affected?
Barracuda’s advisory lists ESG appliance firmware versions 5.1.3.001 through 9.2.0.006 as affected. The Canadian Centre for Cyber Security lists the same range and reports Barracuda’s indication of active exploitation. CISA added CVE-2023-2868 to its Known Exploited Vulnerabilities catalog. These details concern ESG appliance firmware, not every Barracuda product. The Canadian Centre’s alert and CISA’s KEV catalog document the vulnerability’s status.
Do I need to replace my Barracuda Email Security Gateway?
The response depends on whether Barracuda identified the appliance as compromised—not simply whether it ran a version in the affected range.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Vulnerable version, with no known compromise: Barracuda said it applied its security patch across ESG appliances in May 2023. Organizations should confirm the appliance’s status and follow current vendor guidance rather than assume that being in the affected range alone proves compromise.
- Appliance identified as compromised: Barracuda instructed customers to replace it immediately regardless of patch level. Mandiant gave the same recommendation. Barracuda later said it had notified known impacted customers and provided replacement appliances at no cost. Contact Barracuda support if your organization may be affected; do not treat patching alone as remediation for a confirmed compromised appliance.
For suspected compromise, investigate the broader network and hunt for related activity, as Mandiant recommended. A patched appliance does not by itself establish that an earlier intrusion did not occur.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Did the incident affect other Barracuda products?
Barracuda said the 2023 incident affected ESG appliances, not its other products or SaaS email security solutions. The incident should therefore not be described as a compromise of all Barracuda email services.
Is this the same as Barracuda’s later ESG RCE notice?
No. Barracuda’s current ESG documentation also describes a separate RCE issue addressed with hotfixes BNSF-40275 and BNSF-40277 and firmware 9.4.0.027. The company says that fix was released in September 2026 for an issue in a third-party open-source component, handled through a Barracuda patch rather than a CVE disclosure. Those identifiers and fixes are separate from the 2023 CVE-2023-2868 incident. See Barracuda’s separate ESG RCE notice.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
