Barracuda
Monthly
Local privilege escalation in Barracuda RMM (all versions prior to 2025.2.2) enables authenticated Windows users to execute arbitrary code as NT AUTHORITY\SYSTEM by writing malicious files to the insecurely-permissioned C:\Windows\Automation directory. Vendor-released patch version 2025.2.2 addresses the filesystem ACL misconfiguration. EPSS data unavailable; no confirmed active exploitation (not in CISA KEV), though VulnCheck public advisory increases likelihood of POC development. CVSS 8.5 reflects high local impact requiring only low-privileged authentication.
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Random system freeze vulnerability in the Linux kernel's libata-core subsystem affects any Linux host physically equipped with a Seagate ST1000DM010-2EP102 BarraCuda hard drive, where the kernel's default enablement of SATA Link Power Management (LPM) causes the drive to fail its wake sequence and hang the system irrecoverably. The ST1000DM010-2EP102 belongs to the same BarraCuda family as the ST2000DM008-2FR102, for which an LPM quirk already exists in libata - the fix extends that quirk to cover this model. No active exploitation has been identified (absent from CISA KEV), and EPSS at 0.02% reflects negligible adversarial interest, consistent with this being a hardware compatibility defect rather than a traditional security flaw.
Unauthenticated remote attackers can read arbitrary files from Barracuda RMM versions prior to 2025.1.1 by invoking a path-traversal-vulnerable method in the exposed Service Center .NET Remoting service. The assessed impact is high confidentiality loss, with no integrity or availability impact in the independent CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); escalation to remote code execution is possible only if the attacker can retrieve .NET machine keys and use them to forge trusted payloads, so environments with rotated or protected keys and deployments that do not expose the remoting endpoint are at reduced risk. No public exploit has been identified at time of analysis, and EPSS is 0.75% (54th percentile), indicating low predicted near-term exploitation, making the overall urgency elevated rather than critical.
Unauthenticated remote code execution affects the Barracuda Service Center component of Barracuda RMM in all versions prior to 2025.1.1, where a .NET Remoting endpoint deserializes attacker-supplied type data without adequate restrictions. Per the NVD-assigned CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, all impact metrics High, base score 10.0) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), any default installation whose Remoting port is reachable from an untrusted network can be compromised without credentials or user interaction. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is not confirmed as actively exploited; EPSS is 0.71% (52nd percentile), indicating below-median near-term exploitation likelihood, though the trivial attack prerequisites make the practical risk highly dependent on network exposure of the Service Center endpoint.
Remote code execution in Barracuda RMM's Service Center component (versions prior to 2025.1.1) allows unauthenticated network attackers to run arbitrary code on the server by supplying a malicious WSDL whose service name is not properly validated, enabling insecure reflection into arbitrary method calls or deserialization of untrusted types. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) rates it 10.0, matching our independent CVSS 3.1 assessment of 10.0, meaning remote, unauthenticated, no-interaction exploitation with high confidentiality, integrity, and availability impact on both the vulnerable host and subsequent systems. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is only 0.71% (52nd percentile), so severity is maximum but observed exploitation activity remains low; the primary practical limiter is network reachability of the Service Center endpoint, typically the central management server rather than the managed agents.
Unauthenticated remote code execution in the Barracuda RMM Service Center component (part of the RMM managed-service-provider solution) affects all versions prior to 2025.1.1 and allows an attacker to achieve arbitrary file write and drop a webshell by supplying a crafted WSDL document whose URL the application loads without validation. Per the CVSS vector (PR:N/UI:N/AT:N), no authentication, no user interaction, and no non-default configuration are required - the only practical precondition is network reachability of the Service Center endpoint. Publicly available exploit code exists (WatchTowr's SOAPwn research and a VulnCheck advisory), and EPSS is elevated at 24.72% (98th percentile), though the flaw is not confirmed actively exploited (CISA KEV); the scoring reflects a genuine high-priority risk rather than a high-CVSS-but-low-real-risk case.
On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unprivileged local attacker to load a. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Barracuda Message Archiver 2018 has XSS in the error_msg exception-handling value for the ldap_user parameter to the cgi-mod/ldap_load_entry.cgi module. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an improperly protected SSH key. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); fixed in 6.1.0.003 (2017-01-17)) in. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 28.6%.
Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Local privilege escalation in Barracuda RMM (all versions prior to 2025.2.2) enables authenticated Windows users to execute arbitrary code as NT AUTHORITY\SYSTEM by writing malicious files to the insecurely-permissioned C:\Windows\Automation directory. Vendor-released patch version 2025.2.2 addresses the filesystem ACL misconfiguration. EPSS data unavailable; no confirmed active exploitation (not in CISA KEV), though VulnCheck public advisory increases likelihood of POC development. CVSS 8.5 reflects high local impact requiring only low-privileged authentication.
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Random system freeze vulnerability in the Linux kernel's libata-core subsystem affects any Linux host physically equipped with a Seagate ST1000DM010-2EP102 BarraCuda hard drive, where the kernel's default enablement of SATA Link Power Management (LPM) causes the drive to fail its wake sequence and hang the system irrecoverably. The ST1000DM010-2EP102 belongs to the same BarraCuda family as the ST2000DM008-2FR102, for which an LPM quirk already exists in libata - the fix extends that quirk to cover this model. No active exploitation has been identified (absent from CISA KEV), and EPSS at 0.02% reflects negligible adversarial interest, consistent with this being a hardware compatibility defect rather than a traditional security flaw.
Unauthenticated remote attackers can read arbitrary files from Barracuda RMM versions prior to 2025.1.1 by invoking a path-traversal-vulnerable method in the exposed Service Center .NET Remoting service. The assessed impact is high confidentiality loss, with no integrity or availability impact in the independent CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); escalation to remote code execution is possible only if the attacker can retrieve .NET machine keys and use them to forge trusted payloads, so environments with rotated or protected keys and deployments that do not expose the remoting endpoint are at reduced risk. No public exploit has been identified at time of analysis, and EPSS is 0.75% (54th percentile), indicating low predicted near-term exploitation, making the overall urgency elevated rather than critical.
Unauthenticated remote code execution affects the Barracuda Service Center component of Barracuda RMM in all versions prior to 2025.1.1, where a .NET Remoting endpoint deserializes attacker-supplied type data without adequate restrictions. Per the NVD-assigned CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, all impact metrics High, base score 10.0) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), any default installation whose Remoting port is reachable from an untrusted network can be compromised without credentials or user interaction. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is not confirmed as actively exploited; EPSS is 0.71% (52nd percentile), indicating below-median near-term exploitation likelihood, though the trivial attack prerequisites make the practical risk highly dependent on network exposure of the Service Center endpoint.
Remote code execution in Barracuda RMM's Service Center component (versions prior to 2025.1.1) allows unauthenticated network attackers to run arbitrary code on the server by supplying a malicious WSDL whose service name is not properly validated, enabling insecure reflection into arbitrary method calls or deserialization of untrusted types. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) rates it 10.0, matching our independent CVSS 3.1 assessment of 10.0, meaning remote, unauthenticated, no-interaction exploitation with high confidentiality, integrity, and availability impact on both the vulnerable host and subsequent systems. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is only 0.71% (52nd percentile), so severity is maximum but observed exploitation activity remains low; the primary practical limiter is network reachability of the Service Center endpoint, typically the central management server rather than the managed agents.
Unauthenticated remote code execution in the Barracuda RMM Service Center component (part of the RMM managed-service-provider solution) affects all versions prior to 2025.1.1 and allows an attacker to achieve arbitrary file write and drop a webshell by supplying a crafted WSDL document whose URL the application loads without validation. Per the CVSS vector (PR:N/UI:N/AT:N), no authentication, no user interaction, and no non-default configuration are required - the only practical precondition is network reachability of the Service Center endpoint. Publicly available exploit code exists (WatchTowr's SOAPwn research and a VulnCheck advisory), and EPSS is elevated at 24.72% (98th percentile), though the flaw is not confirmed actively exploited (CISA KEV); the scoring reflects a genuine high-priority risk rather than a high-CVSS-but-low-real-risk case.
On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unprivileged local attacker to load a. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Barracuda Message Archiver 2018 has XSS in the error_msg exception-handling value for the ldap_user parameter to the cgi-mod/ldap_load_entry.cgi module. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an improperly protected SSH key. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); fixed in 6.1.0.003 (2017-01-17)) in. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 28.6%.
Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.