Technical impact
Barracuda RMM versions before 2025.2.2 contain a privilege escalation flaw that leverages overly permissive ACLs on the C:\Windows\Automation folder. A local attacker can create or modify automation files in that directory, which are then executed automatically by the system service under the NT AUTHORITY\SYSTEM account during routine automation cycles, typically establishing SYSTEM-level privileges within the next cycle.
Affected Systems
The vulnerability affects Barracuda Networks’ Remote Monitoring and Management (RMM) software on Windows platforms where the C:\Windows\Automation directory is present. All releases prior to version 2025.2.2 are impacted, regardless of other OS or product version details.
Risk and Exploitability
With a CVSS score of 8.5, the flaw is considered High severity. The EPSS score is not available, but the necessity of local file placement suggests that exploitation requires local access, limiting the attack surface. Because the vulnerability can result in full system compromise, the risk is escalated for any environment where local attackers may persist. The flaw is not listed in the CISA KEV catalog, but its impact warrants immediate attention. If an attacker gains local foothold, they can achieve SYSTEM privileges easily by placing malicious scripts in the specified directory.
