CVE-2025-34394 is a critical flaw (CVSS 9.8) in Barracuda Service Center, part of the Barracuda RMM product. Versions before 2025.1.1 expose a .NET Remoting service that does not restrict which types it deserializes, which can lead to remote code execution. Barracuda's fix is the 2025.1 security HotFix.
What's affected
The CVE record lists Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1. The release notes for 2025.1.1 describe a security HotFix for Barracuda RMM 2025.1. They say its purpose is to proactively address security issues around remote code execution, and that these vulnerabilities have not been exploited at the time of the notes.
The HotFix does not update the OMs and DMs, and no reboot is required. Hosted cloud customers should confirm with Barracuda that their tenant is on the fixed build. Self-hosted customers have to apply the fix themselves.
Barracuda lists the HotFix download package at the bottom of the Previous Versions page in its Campus portal, which needs a Campus account.
How to check if you're exposed
Open the RMM console and read the installed version. If it is older than 2025.1.1, or if you run 2025.1 without the security HotFix, treat the server as exposed.
Then look at network reach. Service Center is a server component, so ask who can connect to it. Review firewall rules and any reverse proxy in front of it, and list which source networks can reach the RMM server at all. Remoting services are rarely meant to be reachable from the whole internet.
If you cannot tell which build you run, follow the steps in the Barracuda release notes or ask Barracuda support. Do not guess from the install date.
What to do now
- Find every Barracuda RMM deployment you operate and record its version.
- Download the 2025.1 security HotFix from Campus, or upgrade to a build at or above 2025.1.1.
- Apply it during a maintenance window. Barracuda says no reboot is needed.
- Restrict network access to the Service Center so only trusted management networks can reach it.
- Review server logs and recent file changes for anything unexpected, since this product manages other machines.
Why it matters
The weakness is deserialization of untrusted data (CWE-502). A deserializer rebuilds objects from bytes it receives. If it will rebuild any type the sender names, the sender can pick types whose construction does something harmful. Restricting the allowed types, or not exposing the channel, removes the problem.
A remote monitoring and management server sits at a sensitive point. It talks to many managed endpoints, so code execution on it can be a step toward all of them. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list, and the vendor notes say no exploitation was seen. That is a reason to patch calmly and soon, not to wait.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2025-34394 known to be exploited?
Not according to the record. It is not on the CISA Known Exploited Vulnerabilities list, and Barracuda's release notes say the issues have not been exploited. Patch anyway.
Does the fix need a reboot?
Barracuda's release notes say the HotFix needs no reboot and does not update OMs and DMs.
Sources
Last reviewed: 18 October 2026.
