.NET SOAPwn Flaw Opens Door for File Writes and Remote Code Execution via Rogue WSDL

WatchTowr Labs discovered SOAPwn, an invalid cast vulnerability in the .NET Framework that enables remote code execution through rogue WSDL files. The vulnerability affects multiple enterprise applications including Barracuda Service Center RMM, Ivanti Endpoint Manager (EPM), and Umbraco 8. Attackers can exploit this flaw to achieve file writes and execute arbitrary code remotely. The research suggests many more vendors may be affected beyond those initially identified. This represents a significant threat to enterprise environments using .NET Framework applications.