平台
windows
组件
barracuda-rmm
修复版本
2025.2.2
CVE-2026-22676 describes a privilege escalation vulnerability discovered in Barracuda RMM. This flaw allows a local attacker to elevate their privileges to SYSTEM level, granting them complete control over the affected system. The vulnerability impacts Barracuda RMM versions prior to 2025.2.2 and has been resolved with the release of version 2025.2.2.
The impact of this vulnerability is severe. Successful exploitation allows an attacker with local access to the Barracuda RMM server to gain SYSTEM-level privileges. This means they can execute arbitrary code with the highest privileges on the system, potentially leading to complete compromise. Attackers could modify existing automation content or place malicious files within the vulnerable C:\Windows\Automation directory. These files would then be executed under the NT AUTHORITY\SYSTEM account during routine automation cycles, effectively granting the attacker persistent, high-level access. This is akin to gaining root access on a Linux system, allowing for complete control over the environment and data.
CVE-2026-22676 was publicly disclosed on April 15, 2026. The vulnerability's exploitation context is currently unclear, and no public proof-of-concept (PoC) code has been released. It is not currently listed on the CISA KEV catalog. The ease of exploitation is likely dependent on the attacker's ability to gain local access to the Barracuda RMM server, which may require physical access or successful exploitation of other vulnerabilities.
Organizations utilizing Barracuda RMM for remote monitoring and management, particularly those with legacy configurations or inadequate access controls, are at significant risk. Environments where local administrator access is not strictly controlled or where automation tasks are not regularly reviewed are especially vulnerable. Shared hosting environments utilizing Barracuda RMM also pose a heightened risk due to the potential for cross-tenant exploitation.
• windows / supply-chain:
Get-Acl "C:\Windows\Automation" | Format-List |
Get-ChildItem -Path "C:\Windows\Automation\*" -Recurse -ErrorAction SilentlyContinue |
Select-Object FullName, LastWriteTime, Length• windows / supply-chain:
Get-ScheduledTask | Where-Object {$_.TaskName -like '*Automation*'} |
Select-Object TaskName, State, LastRunTime• windows / supply-chain:
Get-WinEvent -LogName System -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-PowerShell']]]" -MaxEvents 100disclosure
漏洞利用状态
EPSS
0.01% (2% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2026-22676 is to upgrade Barracuda RMM to version 2025.2.2 or later. If an immediate upgrade is not possible due to compatibility concerns or testing requirements, consider restricting access to the C:\Windows\Automation directory. Implement strict access control lists (ACLs) to prevent unauthorized modification of files within this directory. Monitor the directory for any unexpected file changes. While not a complete fix, this can reduce the attack surface. After upgrading, confirm the fix by attempting to execute a file from the C:\Windows\Automation directory with a non-SYSTEM user account; the execution should be denied.
Actualice Barracuda RMM a la versión 2025.2.2 o posterior para mitigar la vulnerabilidad. Esta actualización corrige los permisos de archivo inseguros en el directorio C:\Windows\Automation, previniendo la escalada de privilegios.
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2026-22676 is a HIGH severity vulnerability in Barracuda RMM versions prior to 2025.2.2 that allows local attackers to gain SYSTEM privileges by exploiting overly permissive filesystem ACLs.
You are affected if you are running Barracuda RMM versions 0.0.0–2025.2.2. Upgrade to 2025.2.2 to mitigate the risk.
Upgrade Barracuda RMM to version 2025.2.2 or later. As a temporary workaround, restrict access to the C:\Windows\Automation directory.
Currently, there is no confirmed active exploitation of CVE-2026-22676, and no public proof-of-concept code is available.
Refer to the official Barracuda Networks security advisory for CVE-2026-22676 on their website (check Barracuda's security advisories page).
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。