CVE-2026-22676
Privilege Escalation in Barracuda RMM via Insecure Automation ACLs
Publication date: 2026-04-15
Last updated on: 2026-04-15
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| barracuda | rmm | to 2025.2.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-732 | The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability allows an attacker with local access to escalate their privileges to SYSTEM level.
This means the attacker can execute arbitrary code with the highest privileges on the system, potentially leading to full system compromise.
Such control can be used to steal sensitive data, disrupt services, install malware, or create persistent backdoors.
Can you explain this vulnerability to me?
This vulnerability exists in Barracuda RMM versions prior to 2025.2.2 and involves privilege escalation.
Local attackers can exploit overly permissive filesystem access control lists (ACLs) on the C:\Windows\Automation directory.
By modifying existing automation content or placing attacker-controlled files in this directory, attackers can have their code executed with SYSTEM-level privileges during routine automation cycles.
This typically happens within the next execution cycle, allowing attackers to gain high-level control over the affected system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the permissions on the C:\Windows\Automation directory to see if they are overly permissive, allowing local users to modify or add files.
Suggested commands to detect this issue include checking the Access Control Lists (ACLs) on the directory using Windows command line tools.
- Use the command: icacls C:\Windows\Automation to view the current permissions on the directory.
- Look for permissions that allow modification or write access to non-administrative users.
- Additionally, review any files in this directory that may have been recently modified or added by unauthorized users.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting the permissions on the C:\Windows\Automation directory to prevent unauthorized modification.
- Modify the ACLs to allow only trusted administrative accounts to have write or modify permissions.
- Remove any unauthorized or suspicious files from the directory.
- Upgrade Barracuda RMM to version 2025.2.2 or later, where this vulnerability is fixed.