Threat Actors Allegedly Listed Veeam RCE Exploit for Sale on Dark Web

Veeam Backup & Replication, widely used for data protection, is reportedly the target of a new exploit available on a clandestine marketplace.

A seller identified as "SebastianPereiro" claims to have a remote-code-execution (RCE) exploit affecting specific Veeam 12.x builds.

Known as the "Bug of June 2025," this exploit purportedly bypasses standard authentication mechanisms, providing complete server control. It is associated with a vulnerability labeled CVE-2025-23121, though no public proof-of-concept has been released.

The exploit requires only a valid Active Directory account, making it accessible to threat actors who have obtained domain credentials through phishing or lateral-movement techniques.

The exploit is priced at $7,000 in cryptocurrency , with interested parties instructed to contact the seller privately.

Although a public proof-of-concept has not been shared, the potential impact on backup systems is significant, as compromised systems could be used to exfiltrate, encrypt, or destroy backups.

ThreatMon analysts indicate that enterprises utilizing Veeam Backup & Replication in mixed Windows-Linux environments may be particularly vulnerable due to differences in logging and patch management.

Organizations delaying patch implementation for testing or compliance may inadvertently increase their risk of exposure.

Security teams are advised to audit Active Directory accounts with elevated privileges, verify patch levels on Veeam servers, and monitor for unusual service-account activity.

The exploit reportedly involves improper input validation in Veeam’s REST API endpoint. An attacker can authenticate using any AD account and submit a crafted JSON payload to the /api/sessions/startBackup endpoint, injecting shell commands into the backup session logic.

A simplified proof-of-concept in PowerShell is as follows:

$uri = "https://veeam-server:4443/api/sessions/startBackup" $payload = @{ jobName = "WeeklyBackup"; preScript = "powershell -Enc SQBuAG..." # Base64-encoded malicious command } | ConvertTo-Json Invoke-RestMethod -Uri $uri -Method Post -Body $payload -Credential (Get-Credential) -UseBasicParsing

This payload instructs the service to execute arbitrary PowerShell code under the Veeam service account, granting the attacker elevated privileges and control over backup jobs and repository contents.

Monitoring API traffic and maintaining strict AD account hygiene are essential for detecting and preventing this attack vector.

Based on reporting by Cyber Security News.