Barracuda RMM Flaw Grants SYSTEM Privileges

The National Vulnerability Database recently detailed CVE-2026-22676, a high-severity privilege escalation vulnerability impacting Barracuda RMM versions prior to 2025.2.2. This flaw allows local attackers to achieve SYSTEM-level privileges by manipulating overly permissive filesystem ACLs within the C:\Windows\Automation directory. This isn’t just some run-of-the-mill local privilege escalation; it’s a critical oversight that can hand over the keys to the kingdom.

Attackers can either modify existing automation content or drop their own malicious files into this directory. Once in place, these files are executed under the NT AUTHORITY\SYSTEM account during routine automation cycles. Essentially, if an attacker can get a foothold on a system running vulnerable Barracuda RMM, it’s game over for that machine’s integrity, as they can quickly elevate their access to the highest possible level. The National Vulnerability Database assigns this a CVSS score of 7.8, underscoring its significant impact.