Barracuda identified CVE-2023-2868 on 18 May 2023 after being alerted to anomalous traffic from Email Security Gateway appliances. The flaw sat in a module that screens attachments on incoming mail.
On 6 June the company told customers that compromised ESG appliances must be replaced immediately, regardless of patch level.
Replace, Not Patch
That instruction is rare enough to be the file. A vendor telling customers that its own product cannot be returned to a trustworthy state is an admission that the compromise reached below the level any update can reliably reset.
The corpus has argued the general form of this repeatedly — at 24-0110, where CISA required an integrity check rather than accepting the patch, and at 23-1010, where terminating sessions was necessary because the patch could not invalidate what had leaked. Barracuda is the strongest version: the only trustworthy remediation was new hardware.
Seven Months In The Mail Gateway
Reporting placed exploitation as running for at least seven months before discovery. The device is a security appliance sitting in front of corporate mail, which means the attacker held a position with visibility over everything arriving at the organisation.
The corpus files the same aggravating factor at 26-0705 and 25-0109: a product sold to defend the boundary is, when compromised, the best possible place to stand.
Attribution And Targeting
Mandiant attributed the activity to a China-nexus cluster it tracks as UNC4841 and described targeting across public and private sector organisations. This desk records that as Mandiant’s assessment.
The jurisdiction on this file is deliberately absent rather than set to the actor’s suspected origin. The affected organisations were distributed across many countries, and the corpus does not record an attributed origin as a fact about the victims.
Built on Barracuda’s own trust-centre notice on the ESG vulnerability and on Rapid7’s technical analysis of the compromise and the replacement guidance. The 18 May identification date and the 6 June replacement instruction are Barracuda’s. The seven-month exploitation window and the UNC4841 attribution are from Mandiant’s research as reported, recorded as an assessment rather than a finding of this desk. No victim count is asserted; the "hundreds of organisations" characterisation in reporting is not a figure this desk can verify. No indicators are reproduced. Graded high. Corrections: corrections@forensicpost.com.