Critical Veeam Backup RCE Vulnerabilities Let Attackers Execute Malicious Code Remotely
Veeam Software has identified three critical security vulnerabilities within its Backup & Replication suite and Agent for Microsoft Windows. These flaws enable remote code execution (RCE) and privilege escalation, posing a risk to enterprise backup…
Veeam Software has identified three critical security vulnerabilities within its Backup & Replication suite and Agent for Microsoft Windows. These flaws enable remote code execution (RCE) and privilege escalation, posing a risk to enterprise backup infrastructures.
Recent updates have addressed these vulnerabilities, which primarily affect domain-joined systems in version 12 of the software. Organizations are advised to apply these patches promptly to mitigate risks of data breaches or ransomware attacks.
CVE ID Description Severity CVSS v3.1 Score Affected Versions Patched Version
CVE-2025-48983 Veeam Backup & Replication 12.3.2.3617 and all earlier versions Critical 9.9 Veeam Backup & Replication 12.3.2.3617 and earlier versions 12.3.2.4165 Patch
CVE-2025-48984 RCE vulnerability on the Backup Server by authenticated domain users Critical 9.9 Veeam Agent for Microsoft Windows 6.3.2.1205 and earlier versions 12.3.2.4165 Patch
CVE-2025-48982 Local privilege escalation in Veeam Agent for Microsoft Windows High 7.3 Versions up to 6.3.2.1205 6.3.2.1302
Veeam Software has identified three critical security vulnerabilities within its Backup & Replication suite and Agent for Microsoft Windows.
Mount Service RCE Threatens Backup Hosts
The vulnerability CVE-2025-48983 is located in the Mount service of Veeam Backup & Replication. It allows an authenticated domain user to execute arbitrary code on backup infrastructure hosts.
With a CVSS v3.1 score of 9.9, this issue was reported by CODE WHITE and affects all version 12 builds up to 12.3.2.3617, including unsupported older releases. Veeam advises that only domain-joined configurations are vulnerable, whereas the Veeam Software Appliance and upcoming version 13 remain unaffected.
The patch, build 12.3.2.4165, strengthens the service against unauthorized code injection. Administrators should follow Veeam's best practices, preferring workgroup setups over domain integration for improved security.
Backup Server Exposed to Domain User Attacks
The CVE-2025-48984 vulnerability is another critical RCE issue targeting the Backup Server, exploitable by authenticated domain users. It shares the same affected versions as CVE-2025-48983, limited to domain-joined Veeam Backup & Replication v12 environments.
This flaw, discovered by Sina Kheirkhah and Piotr Bazydlo of watchTowr, highlights the risk of over-privileged domain access in backup systems, potentially enabling lateral movement across networks. The patch 12.3.2.4165 addresses this vulnerability, emphasizing the importance of timely updates in hybrid or Active Directory-integrated setups.
Agent's Restore Flaw Enables Privilege Escalation
Alongside the RCE issues, CVE-2025-48982 concerns Veeam Agent for Microsoft Windows, allowing local privilege escalation if an administrator restores a malicious file. Rated high severity with a 7.3 CVSS score, this issue was reported via Trend Micro's Zero Day Initiative and affects versions up to 6.3.2.1205.
Exploitation requires tricking a user into restoration, potentially elevating attacker privileges significantly. The patch in build 6.3.2.1302 is essential for endpoint protection in Windows environments. Veeam recommends verifying all agent instances and isolating backups to reduce social engineering risks.
Organizations using affected versions should prioritize updates to protect against code execution threats.
Based on reporting by Cyber Security News.