Barracuda RMM
CVE-2025-34394
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed .NET Remoting port
-
DeliveryCraft malicious serialized gadget payload
-
ExploitTrigger unsafe deserialization of arbitrary type
-
ExecutionExecute arbitrary code on Service Center
-
ImpactPivot to RMM-managed endpoints
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the .NET Remoting service exposed by the Barracuda Service Center component of Barracuda RMM in versions prior to 2025.1.1. The primary limiting factor is network exposure of that Remoting endpoint - deployments that firewall or network-segment the Service Center management service away from untrusted networks substantially reduce reachability and realistic risk. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or non-default configuration is needed, so any default install whose Remoting port is reachable by an attacker is directly exploitable; upgrading to 2025.1.1 removes the vulnerable deserialization behavior. |
| Impact | All severity signals align toward high priority. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with high impact across both the vulnerable and subsequent systems (VC/VI/VA:H and SC/SI/SA:H), yielding a maximal 10.0 score - consistent with a CWE-502 untrusted-deserialization flaw in a .NET Remoting endpoint, a vulnerability class with well-understood, reliable RCE gadget chains (e.g., ysoserial.net). The counterweight is exploitation evidence: this is NOT on CISA KEV, no public POC is referenced, and EPSS is only 0.71% (52nd percentile), indicating no observed in-the-wild activity yet. The low EPSS despite a perfect CVSS is expected for a freshly disclosed niche-product flaw and should not be read as low real risk - deserialization RCE in a management platform is a high-value target and EPSS lags disclosure. Net: treat as a genuine high-priority patch, driven by exploitability class and impact rather than by any confirmed exploitation. Note the signal mismatch to flag explicitly: severity is maximal but exploitation-probability signals are low/absent, so prioritize on technical impact and vulnerability class, not on current exploitation telemetry. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network reachability to the Barracuda Service Center host sends a crafted serialized .NET object to the exposed .NET Remoting service; because arbitrary types are deserialized, a known gadget chain executes attacker-controlled code on the server. No public exploit is identified in the data, but .NET Remoting deserialization is trivially weaponizable with existing tooling, and the low attack complexity (AC:L) means no special timing or environmental conditions are required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Unauthenticated remote code execution affects the Barracuda Service Center component of Barracuda RMM in all versions prior to 2025.1.1, where a .NET Remoting endpoint deserializes attacker-supplied type data without adequate restrictions. Per the NVD-assigned CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, all impact metrics High, base score 10.0) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), any default installation whose Remoting port is reachable from an untrusted network can be compromised without credentials or user interaction. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is not confirmed as actively exploited; EPSS is 0.71% (52nd percentile), indicating below-median near-term exploitation likelihood, though the trivial attack prerequisites make the practical risk highly dependent on network exposure of the Service Center endpoint.
RemediationAI
Barracuda-released patch: upgrade Barracuda RMM to version 2025.1.1 or later, which removes the vulnerable deserialization behavior in the Service Center component; the vendor's release notes documenting this version are at https://download.mw-rmm.barracudamsp.com/PDF/2025.1.1/RN_BRMM_2025.1.1_EN.pdf and should be followed in full, including any component-restart or Service Center redeployment steps, since both the RMM server-side Service Center and any management hosts that communicate with it need to be on the fixed build. Until upgrading is possible, the most effective compensating control is to firewall the .NET Remoting listener of the Barracuda Service Center so it is reachable only from trusted management subnets or allow-listed administrator hosts - the trade-off is that any legitimate remote administration or RMM agent traffic that depends on that endpoint must be routed through the trusted segment or will break, and this control must be reviewed because the listener may bind additional dynamic ports. Network-segmenting the Service Center away from internet-facing and untrusted networks substantially reduces reachability, and because the exploit path requires no authentication (PR:N) or user interaction (UI:N), there is no credential-hardening or user-awareness measure that meaningfully mitigates exposure - restricting network access and accelerating the upgrade to 2025.1.1 are the only reliable defenses. Organizations that cannot immediately migrate should treat any host that could reach the Remoting endpoint as potentially compromised and monitor for anomalous child processes spawned by the RMM service.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-502, Deserialization of Untrusted Data, and arises from the Barracuda Service Center service shipped as part of the Barracuda RMM managed-service-provider platform. That component exposes a .NET Remoting service, a legacy Microsoft remoting framework whose default formatters (BinaryFormatter/SoapFormatter) reconstruct arbitrary object graphs on the server from serialized streams. Because the endpoint accepts type and assembly metadata from the caller and does not sufficiently restrict which types may be instantiated, an attacker who can reach the Remoting listener can supply a crafted serialized payload that triggers gadget-chain execution during deserialization, yielding code execution in the context of the service. The CPE entry cpe:2.3:a:barracuda:rmm:*:*:*:*:*:*:*:* confirms that the entire Barracuda RMM product line before the 2025.1.1 release is in scope, with no platform or edition qualifier limiting the affected configurations. As with other .NET Remoting deserialization flaws, the attack surface is the network-reachable Remoting channel itself, and the CVSS 4.0 vector's AV:N/AC:L/PR:N/UI:N profile shows that neither authentication, user interaction, nor a non-default configuration is required to attempt exploitation - the sole practical precondition is that the Service Center management service be reachable by the attacker.
Know when Barracuda gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Remote unauthenticated low-complexity deserialization RCE (AV:N/AC:L/PR:N/UI:N); scope changed (S:C) since code execution on Service Center impacts managed endpoints, with full C/I/A loss.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service that is insufficiently protected against deserialization of arbitrary types. This can lead to remote code execution.
Executive ViewAI
Barracuda RMM's Service Center component presents a critical, unauthenticated remote code execution risk for organizations running affected versions with the Remoting endpoint reachable from untrusted networks. A successful compromise could give an attacker control of the RMM server and potentially cascade into managed endpoints and customer environments; no public exploit identified at time of analysis; No vendor-released patch identified at time of analysis; leadership should prioritize identifying exposed instances and reducing network reachability immediately because the vulnerability is rated CVSS 10.0 and the affected platform is a high-trust management system.
Restrict network access to the Barracuda RMM Service Center .NET Remoting endpoint; allow only trusted management hosts via firewall or ACL; segment the RMM server from untrusted networks; disable or block the Remoting port if not required; monitor for anomalous Remoting or deserialization traffic. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Unauthenticated remote code execution in the Barracuda RMM Service Center component (part of the RMM managed-service-pro
A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (20
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Rated critical severity (CVSS 9.8), thi
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) pro
The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a
On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injectio
Remote code execution in Barracuda RMM's Service Center component (versions prior to 2025.1.1) allows unauthenticated ne
Barracuda Message Archiver 2018 has XSS in the error_msg exception-handling value for the ldap_user parameter to the cgi
Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an improperly protected SSH key.
Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015. Rated critical severity (CVSS 9.8), this vulnerability
Unauthenticated remote attackers can read arbitrary files from Barracuda RMM versions prior to 2025.1.1 by invoking a pa
Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. Rated hi
GitHub PoC
Exploit-DB