# Barracuda Email Security Gateway zero-day (CVE-2023-2868) · pwn.watch

> A command injection in how Barracuda ESG appliances scan .tar attachments was exploited since October 2022 by China-nexus UNC4841 to backdoor appliances. Barracuda later told customers to replace compromised appliances outright, even after patching.

Page: https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868 · generated 2026-10-22T19:29:07.289Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: Barracuda Email Security Gateway (appliance)
- Started: 2023-05-18 · closed: 2023-06-15
- CVEs: CVE-2023-2868
- Affected: 5.1.3.001 to 9.2.0.006 (appliance form factor only) (NVD)
- Fixed in: See vendor advisory (patch pushed to all appliances May 20–21, 2023; compromised appliances must be replaced)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868/feed.xml
- JSON Feed: https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868.json
- This file: https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868/llms.txt

## Updates (newest first)
- 2023-06-15: Mandiant attributes the campaign to China-nexus UNC4841 (https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally)
- 2023-06-06: Barracuda tells customers to replace compromised appliances immediately, regardless of patch level (https://www.barracuda.com/company/legal/esg-vulnerability)
- 2023-05-30: Barracuda: exploitation dates back to October 2022, with SALTWATER, SEASPY and SEASIDE malware (https://www.barracuda.com/company/legal/esg-vulnerability)
- 2023-05-26: CISA adds CVE-2023-2868 to the KEV catalog
- 2023-05-20: Security patch pushed to all ESG appliances worldwide (https://www.barracuda.com/company/legal/esg-vulnerability)
- 2023-05-18: Barracuda notices anomalous traffic from ESG appliances (https://www.barracuda.com/company/legal/esg-vulnerability)

## Fix brief
# Security brief: Barracuda Email Security Gateway zero-day (CVE-2023-2868)

Source: https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868 · status: closed (closed Jun 15, 2023) · severity: critical · updated Jun 15, 2023

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A command injection in how Barracuda ESG appliances scan .tar attachments was exploited since October 2022 by China-nexus UNC4841 to backdoor appliances. Barracuda later told customers to replace compromised appliances outright, even after patching.

Severity detail: CVSS 9.8 (NVD), zero-day, actively exploited (CISA KEV)

- Product: Barracuda Email Security Gateway (appliance)
- CVE / advisory ids: CVE-2023-2868

## Affected versions
- 5.1.3.001 to 9.2.0.006 (appliance form factor only) (NVD)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- See vendor advisory (patch pushed to all appliances May 20–21, 2023; compromised appliances must be replaced)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Jun 15, 2023: Mandiant attributes the campaign to China-nexus UNC4841
- Jun 6, 2023: Barracuda tells customers to replace compromised appliances immediately, regardless of patch level
- May 30, 2023: Barracuda: exploitation dates back to October 2022, with SALTWATER, SEASPY and SEASIDE malware
- May 26, 2023: CISA adds CVE-2023-2868 to the KEV catalog
- May 20, 2023: Security patch pushed to all ESG appliances worldwide
- May 18, 2023: Barracuda notices anomalous traffic from ESG appliances

## Advisories
- [Barracuda Email Security Gateway Appliance (ESG) Vulnerability](https://www.barracuda.com/company/legal/esg-vulnerability) (Barracuda)
- [NVD: CVE-2023-2868](https://nvd.nist.gov/vuln/detail/CVE-2023-2868) (NVD)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)

## Write-ups & news
- [Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor, Suspected Links to China](https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally)

## Caveats
startedAt is detection; exploitation began in October 2022 per Barracuda.

---
Machine-readable: https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.