Barracuda EUVD-2026-23116

Exploitation requires authenticated local or remote logon access to a Windows system running vulnerable Barracuda RMM agent (any version prior to 2025.2.2). Attacker must possess low-privileged user credentials (PR:L in CVSS vector) with interactive logon rights or ability to write files via remote session. The specific prerequisite is default insecure ACLs on C:\Windows\Automation directory that permit Modify or Write access to low-privileged users-this is the vulnerable default configuration in affected RMM versions. No special RMM features, non-default settings, or user interaction required (AC:L/UI:N). Exploitation is NOT possible against: systems without Barracuda RMM agent installed, patched agents running 2025.2.2+, or environments where administrators have manually hardened C:\Windows\Automation ACLs prior to patching. Limiting factor: requires existing foothold on target endpoint (network-only attackers cannot exploit without first compromising valid credentials for local/remote logon).

CVSS 8.5 (High) with AV:L/AC:L/PR:L indicates straightforward local exploitation requiring only low-privileged authenticated access, which aligns with realistic insider threat or post-compromise lateral movement scenarios. The high confidentiality/integrity/availability impact (VC:H/VI:H/VA:H) with no scope change (SC:N) reflects complete Windows host compromise limited to the targeted system. No EPSS score provided, preventing quantitative exploitation probability assessment. CISA KEV status is negative, indicating no confirmed widespread or targeted exploitation campaigns at time of analysis. VulnCheck advisory publication significantly increases POC development risk, as the exploitation technique (writing to insecure directory) is trivial for attackers with existing foothold. The CVSS:4.0 environmental metrics (all 'X' unspecified) and SSVC framework data are absent, limiting contextualized risk assessment. Real-world priority is MODERATE-to-HIGH for MSPs with Barracuda RMM deployments: while requiring prior authentication, the low attack complexity and SYSTEM-level impact make this attractive for ransomware operators or APT actors performing post-exploitation privilege escalation on managed endpoints. Organizations should prioritize patching if RMM agents run on sensitive hosts (domain controllers, jump servers, privileged access workstations).

Attacker compromises low-privileged domain user credentials via phishing or credential stuffing, then establishes RDP or remote shell access to a Windows endpoint with Barracuda RMM agent installed. Attacker navigates to C:\Windows\Automation directory, writes a malicious PowerShell script (e.g., reverse shell payload, credential dumper, or ransomware dropper) disguised as legitimate automation content or overwrites existing .ps1/.bat files. Within the next scheduled automation cycle (typically 5-60 minutes depending on RMM policy configuration), the RMM agent service executes the attacker's script under NT AUTHORITY\SYSTEM context, granting complete host control for lateral movement, data exfiltration, or persistence establishment across the MSP's managed infrastructure.