“Impacted ESG appliances must be immediately replaced regardless of patch version level.”
Barracuda patched CVE-2023-2868 on May 20, then told customers on June 6 to throw the boxes out. Attackers had been exploiting the attachment scanner since October 2022. Rapid7 counts roughly 11,000 vulnerable gateways still online. The appliance sold to inspect every email became the best seat in the house for reading it.