Barracuda identified a vulnerability (CVE pending) in our Email Security Gateway appliance (ESG) on May 19, 2023.

Investigating – Barracuda identified a vulnerability (CVE pending) in our Email Security Gateway appliance (ESG) on May 19, 2023. A security patch to eliminate the vulnerability was applied to all ESG appliances worldwide on Saturday, May 20, 2023. The vulnerability existed in a module which initially screens the attachments of incoming emails. No other Barracuda products, including our SaaS email security services, were subject to this vulnerability.

We took immediate steps to investigate this vulnerability. Based on our investigation to date, we’ve identified that the vulnerability resulted in unauthorized access to a subset of email gateway appliances. As part of our containment strategy, all ESG appliances have received a second patch on May 21, 2023. Users whose appliances we believe were impacted have been notified via the ESG user interface of actions to take. Barracuda has also reached out to these specific customers.

We will continue actively monitoring of this situation, and we will be transparent in sharing details on what actions we are taking. Information gathering is ongoing as part of the investigation. We want to ensure we only share validated information with actionable steps for you to take. As we have information to share, we will provide updates via this product status page ( and direct outreach to impacted customers. Updates are also located on Barracuda’s Trust Center (

Barracuda’s investigation was limited to the ESG product, and not the customer’s specific environment. Therefore, impacted customers should review their environments and determine any additional actions they want to take.

Your trust is important to us. We thank you for your understanding and support as we work through this issue and sincerely apologize for any inconvenience it may cause. If you have any questions, please reach out to
May 23, 2023 – 20:28 UTC

If you need assistance let me know 9 years with Barracuda

Do You Need To Step Up Zero Trust Strategy?

Folks if you are reading this you have to lock down your security products
Quick Outline please do not be lazy and take to heed my comments. Most companies I have seen lately are calling your clients, As I have instructed my own MSP’s/Resellers make up these accounts in the DB, you own them they do not.. but legally if you provide that information to them you grant them access

See 6 new breaches below


RMM programs are hurting and trying to entice you into one window pane of glass RMM is nothing more the remote management with some reports as to the health of a machine/device that is it even there Remote tools are 3rd party API’s or hooks remote tools should only be Point to Point from a dashboard to the endpoint. The best program is Barracuda ( over 50% or more off SRP through MspPortal Partners Inc) no security breaches like Kaseya and Enable(formally Solarwinds, GFI, LogicNow, Houndog). Kaseya is on a spend Spree and is acquiring firms to add to there portfolio’s churn and burn at your expense. Read the EULA’s all they have to do is apologize and not compensate you a dime for your time to fix.

Every Security company out there has escape clauses WRONG. QUIT Signing contracts We do 3rd line support ourselves.

Mail-Filtering and Backups of O365

O365 is a joke. If you let your client sway you and setup O365 for them you have better protect yourself and your clients.
Barracuda has 3 mail programs Essentials, Complete Mail Protection, Total Mail Protection, MspPortal Partners Inc is a major player Barracuda Arena we offer almost 50% off of SRP if you were to buy direct thru Barracuda that is if a Salesperson contacts you back. We do 3rd line support ourselves.

Malware Detection/Antivirus

Bitdefender is the only product rated # 1. All other firms do extensive marketing with pretty pictures. This is truly a tech dashboard you control the client and the actions. Bitdefender claims (per article they wrote) that MspPortal Partners Inc is there largest provider to MSP’s. We do 3rd line support ourselves.

Hosted Mail
Last we are a partner with ZOHO. We have worked for over 4 months with them fixing there bugs to make it a competitor to O365..Downfall no US support they are based out of India. You need somebody like MspPortal to support you.

If you need pricing contact us, no contracts only month to month we believe if we are doing our job you stay if not you leave no grief. All we expect is you pay your invoices once a month.

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, RackSpace, Axcient
“Where Service and Technical Skills Count”
Phone: 480-275-6900

Related Articles Breachs:

Food distribution giant Sysco warns of data breach after cyberattack

Cold storage giant Americold outage caused by network breach

Dole discloses employee data breach after ransomware attack

Western Digital says hackers stole customer data in March cyberattack

Hackers leak images to taunt Western Digital’s cyberattack response

T-Mobile discloses second data breach since the start of 2023

Microsoft Patches Serious Azure Cloud Security Flaws

By Elizabeth Montalbano
Three vulnerabilities in the platform’s API Management Service could allow access sensitive data, mount further attacks, and even hijack developer portals.

Microsoft has patched three vulnerabilities in its Azure cloud platform that could have allowed attackers to access sensitive info on a targeted service, deny access to the server, or scan the internal network to mount further attacks, researchers have found.

Researchers from the Ermetic Research Team discovered the flaws in the Azure API Management Service, which allows organizations to create, manage, secure, and monitor APIs across all of their environments, they revealed in a blog post published May 4.

The flaws — all rated high-risk — include two Server-Side Request Forgery (SSRF) vulnerabilities and a file upload path traversal on an internal Azure workload.

SSRF allows an attacker to send a crafted request from a vulnerable server to a targeted external or internal server or service, or even target it in a denial-of-service (DoS) attack. Abusing these flaws means an attacker can access sensitive data stored on the targeted server, overload targeted servers using DoS attacks, and scan the internal network and identify potential targets for further attacks.

The third flaw is one in which Azure does not validate the file type and path of uploaded files. Typically in the case of this type of flaw, authenticated users can traverse the path specified to upload malicious files to the developer portal server and possibly execute code on it using DLL hijacking, IISNode config swapping, or any other similar attack vectors, the researchers said.

Microsoft responded quickly to Ermetic’s disclosure of the flaws and has fully patched them, according to the researchers, and no further action is necessary for Azure customers.
Details on the Bugs

Specifically, the Ermetic researchers discovered two separate SSRF flaws: one that affected the Azure API Management CORS Proxy and another that affected the Azure API Management Hosting Proxy.

They discovered the former on Dec. 21, 2022, and at first believed it was the same flaw that was first reported to Microsoft by another cloud security company on Nov. 12, and fixed a few days later on Nov. 16. However, the researchers later realized that the flaw they found actually bypasses that initial fix. Microsoft ultimately patched the vulnerability fully in January, the initial researchers reported later, according to Ermetic.

Together, the Azure SSRF flaws that researchers discovered affected central servers that “masses of users and organizations depend on for day-to-day operations,” says Liv Matan, cloud security researcher at Ermetic.

“Using them, attackers could fake requests from these legitimate servers, access internal services that may contain sensitive information belonging to Azure customers, and even prevent the availability of the vulnerable servers,” he says.

The path-traversal flaw found in Azure API Management Service allowed for an unrestricted file upload to the Azure developer portal server, the researchers said. The developer portal’s authenticated mode allowed someone to upload static files and images that would be shown on a developer’s dedicated portal, they said.

The flaw could have allowed attackers to take advantage of Microsoft’s self-hosted developer portal as well as weaponize the vulnerability against end users, Matan explains.

“Additionally, the Azure-hosted developer portal contains customer information that would have been at risk if the vulnerability had fallen into the wrong hands,” he says.
How to Protect the Enterprise

While API flaws like the ones Ermetic researchers discovered are uncommon, awareness of these types of vulnerabilities has grown in the past few years, Matan says.

Moreover, “blind SSRFs” — SSRF flaws that do not necessarily return any data but rather focus on performing unauthorized actions on the server’s backend — are fairly common, especially in cloud platforms that offer a wide range of services, he says.

Microsoft already had previously patched four SSRF flaws in four separate services of its Azure cloud platform, two of which could have allowed attackers to perform a server-side request forgery (SSRF) attack — and thus potentially execute remote code execution — even without authentication to a legitimate account.

“In the end, vulnerabilities can be discovered in any cloud platform, at any time,” Matan says.

There’s certainly been evidence of this, as — aside from SSRF flaws — researchers already have found a number of other flaws in Azure as well as other cloud platforms that could have threatened enterprise environments.

In one instance, Microsoft patched what researchers called a “dangerous” flaw in its Azure Service Fabric component that, if exploited, would have allowed an unauthenticated, malicious actor to execute code on a container hosted on the platform.

Because it’s difficult for an enterprise deploying a cloud to have control over or even be aware of a flaw on the underlying cloud-hosting infrastructure, it’s important for organizations to be vigilant in their own security practices so they are prepared if a flaw is eventually discovered or exploited, the researchers said.

In the case of avoiding compromising in the recently discovered Azure API Management, Matan recommends that organizations should practice proper input-validation hygiene and configure their servers to not follow redirects.

“To avoid a compromise in these cases, organizations should validate all input received from untrusted sources, such as user inputs or HTTP requests,” he says.

Other steps organizations can take to avoid compromise in these cases, Matan adds, include using a whitelist approach, implementing a strong firewall to restrict outgoing traffic from the application to only necessary services and ports, isolating data, and managing permissions on the server in cloud environments using IMDSv2.

Link (

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”