CVE-2025-34393 is a critical flaw (CVSS 9.8 in the record) in Barracuda Service Center, part of Barracuda RMM. The service name in an attacker controlled WSDL is not checked, which leads to insecure reflection and possible remote code execution. Versions before 2025.1.1 are affected. Upgrade to 2025.1.1 or later.
What's affected
The record says versions prior to 2025.1.1 of Barracuda Service Center in the RMM solution are affected. The VulnCheck advisory lists RMM below 2025.1.1 and credits Piotr Bazydlo of watchTowr. The vendor release notes for 2025.1.1 are linked from the record.
This is one of three related CVEs in the same component. The others are CVE-2025-34392 and CVE-2025-34394. They describe different mechanisms with the same outcome and the same fixed floor.
I did not find a workaround in the sources, so the update is the supported remedy.
How to check if you're exposed
Check the version of your Barracuda RMM installation in the console or the installed programs list. Anything older than 2025.1.1 is affected.
Then examine exposure. Ask whether Service Center can be reached from the internet, and from which networks. RMM servers are often reachable by design, so the useful question is whether access is limited to the addresses that need it.
Look at the host for signs of misuse: unexpected child processes of the web service, new services, new scheduled tasks and unfamiliar accounts. The advisory describes the result as code execution through invoking methods or deserializing unexpected types, which would not necessarily leave a file behind, so process and log review matter. Hand anything suspicious to your incident response team.
What to do now
- Upgrade Barracuda RMM to 2025.1.1 or later.
- Limit network access to Service Center to the addresses that need it, and put administrative interfaces behind a VPN.
- Review process, service and account activity on the RMM host for anything you cannot explain.
- If compromise is possible, rotate secrets stored in the platform and review actions taken on managed endpoints.
- Patch for CVE-2025-34392 and CVE-2025-34394 at the same time, as they share the fix.
Why it matters
The class is CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), known as unsafe reflection. Reflection lets a program pick a class or method by name at run time. When that name comes from outside, the caller decides what code runs. The advisory describes two outcomes: invoking arbitrary methods, or deserializing types the developer never intended.
The defense is to map outside values to a fixed allow list of known services and never pass a raw name to the reflection call. It is a pattern that appears again and again in .NET and Java applications, and a dependency scan will not find it in your own code. A static code scan is the right tool there, and a runtime or reachability view helps decide what to fix first. The record does not list the CVE in CISA KEV.
Quick check
What does insecure reflection mean in plain words?
The program uses a name it received from outside to decide which code to run. If an attacker picks the name, they pick the code.
Is the fix the same as for the other two Barracuda CVEs?
Yes. All three list 2025.1.1 as the first fixed release.
Sources
Last reviewed: 18 October 2026.
