SOAPwn Vulnerabilities in .NET Expose Major Devices to RCE Attacks

First seen 11 Dec 2025, 18:52 UTC • Gbhackers

•51

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Security researchers have identified a new class of vulnerabilities, termed 'SOAPwn', affecting the .NET Framework. These vulnerabilities can be exploited for remote code execution (RCE) across various enterprise products, including Barracuda, Ivanti, and Microsoft devices. The research highlights risks associated with legacy .NET Framework SOAP client code.

How this analysis works

Attack Flow

12 entities, 14 inferred relationships (STIX 2.1).

Technique (1)

Remote Code Execution

Organization (5)

Barracuda
Ivanti
Microsoft
Microsoft Devices
Umbraco

Affected Platform (5)

Barracuda Service Center RMM
Ivanti Endpoint Manager
Microsoft PowerShell
SQL Server Integration Services
Umbraco CMS 8

Vulnerability (1)

SOAPwn

Relationships

SOAPwn targets Barracuda Service Center RMM
SOAPwn targets Ivanti Endpoint Manager
SOAPwn targets Microsoft PowerShell
SOAPwn targets SQL Server Integration Services
Remote Code Execution targets Barracuda Service Center RMM
Remote Code Execution targets Ivanti Endpoint Manager
Remote Code Execution targets Microsoft PowerShell
Remote Code Execution targets SQL Server Integration Services
SOAPwn related to Barracuda
SOAPwn related to Ivanti
SOAPwn related to Microsoft
SOAPwn related to Microsoft Devices
SOAPwn related to Umbraco
SOAPwn related to Umbraco CMS 8

Continue Reading

TeamPCP Hackers Arrested for Major Supply Chain Attacks Microsoft's .NET RCE Bug Remains Unfixed, Affecting Enterprise Applications Microsoft Defender Claims Superior Email Security Performance Over Competitors

SOAPwn Vulnerabilities in .NET Expose Major Devices to RCE Attacks

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading