Barracuda RMM Privilege Escalation Vulnerability in Automation Directory

A privilege escalation vulnerability has been identified in Barracuda RMM versions prior to 2025.2.2. This vulnerability allows local attackers to gain SYSTEM-level privileges by exploiting overly permissive filesystem access control lists (ACLs) on the C:\Windows\Automation directory. Attackers can either modify existing automation content or introduce their own files into this directory. These files are executed under the NT AUTHORITY\SYSTEM account during regular automation cycles, usually within the next execution cycle.

Impact

Exploitation of this vulnerability allows local attackers to gain SYSTEM-level privileges.

Remediation

Users are advised to update to Barracuda RMM version 2025.2.2 or later. Instructions for updating Onsite Managers and Device Managers are available in the Barracuda RMM Release Notes for version 2025.2.2.