New “SOAPwn” .NET Vulnerabilities Expose Barracuda, Ivanti and Microsoft Appliances to RCE Attack

SOAPwn is a class of vulnerabilities in .NET SOAP HTTP client proxy implementations that allow attacker-controlled WSDL/URL input to change request schemes (including file:// and UNC), enabling NTLM relay, arbitrary file writes to web-accessible paths, and full remote code execution; multiple enterprise products (Barracuda Service Center RMM, Ivanti Endpoint Manager, Umbraco 8, PowerShell, SSIS) are affected, with at least one tracked CVE (CVE-2025-34392) and vendor fixes or advisories, while Microsoft has classified the issue as an application-layer problem rather than fixing the framework itself.