Barracuda RMM < 2025.2.2 Privilege Escalation via Insecure Directory Permissions

The impact of this vulnerability is severe. Successful exploitation allows an attacker with local access to the Barracuda RMM server to gain SYSTEM-level privileges. This means they can execute arbitrary code with the highest privileges on the system, potentially leading to complete compromise. Attackers could modify existing automation content or place malicious files within the vulnerable C:\Windows\Automation directory. These files would then be executed under the NT AUTHORITY\SYSTEM account during routine automation cycles, effectively granting the attacker persistent, high-level access. This is akin to gaining root access on a Linux system, allowing for complete control over the environment and data.

Organizations utilizing Barracuda RMM for remote monitoring and management, particularly those with legacy configurations or inadequate access controls, are at significant risk. Environments where local administrator access is not strictly controlled or where automation tasks are not regularly reviewed are especially vulnerable. Shared hosting environments utilizing Barracuda RMM also pose a heightened risk due to the potential for cross-tenant exploitation.

• windows / supply-chain:

Get-Acl "C:\Windows\Automation" | Format-List |
Get-ChildItem -Path "C:\Windows\Automation\*" -Recurse -ErrorAction SilentlyContinue |
Select-Object FullName, LastWriteTime, Length

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*Automation*'} |
Select-Object TaskName, State, LastRunTime

• windows / supply-chain:

Get-WinEvent -LogName System -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-PowerShell']]]" -MaxEvents 100

1. 2026-04-15Disclosure

   disclosure

1. आरक्षित2026-01-08
2. प्रकाशित2026-04-15
3. संशोधित2026-04-16
4. EPSS अद्यतन2026-04-23

The primary mitigation for CVE-2026-22676 is to upgrade Barracuda RMM to version 2025.2.2 or later. If an immediate upgrade is not possible due to compatibility concerns or testing requirements, consider restricting access to the C:\Windows\Automation directory. Implement strict access control lists (ACLs) to prevent unauthorized modification of files within this directory. Monitor the directory for any unexpected file changes. While not a complete fix, this can reduce the attack surface. After upgrading, confirm the fix by attempting to execute a file from the C:\Windows\Automation directory with a non-SYSTEM user account; the execution should be denied.