CVE-2025-34392
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-
CVSS
9.8
Critical
EPSS
24.7%
p98
KEV
—
Exploit Today
29
0-100
Published: Dec 10, 2025 · Last modified: Oct 14, 2026 · CWE-36
24.7%EPSS · 30 days24.7%
2026-09-242026-10-22
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.
- download.mw-rmm.barracudamsp.comhttps://download.mw-rmm.barracudamsp.com/PDF/2025.1.1/RN_BRMM_2025.1.1_EN.pdf
- labs.watchtowr.comhttps://labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl/
- www.barracuda.comhttps://www.barracuda.com/products/msp/network-protection/rmm
- www.vulncheck.comhttps://www.vulncheck.com/advisories/barracuda-rmm-service-center-absolute-path-traversal-rce
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-837848.8 HIG61.0%
——18Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.7dCVE-2026-837468.1 HIG62.9%
——19Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.10dCVE-2026-836836.5 MED66.2%
——20Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network.7dCVE-2026-702978.8 HIG63.2%
——19Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.10dCVE-2026-55062—8.2%
——2uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.30dCVE-2025-708203.5 LOW7.5%
——2Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.9d