AI analysis
CVE-2025-64392 is a cross-site scripting flaw (CWE-79) in Veeam Backup Enterprise Manager. An attacker can run script in the browser of a portal user who opens a crafted link; the issue is reachable over the network, needs low privileges and that the user actively open the link, and is scored CVSS 4.0 4.8 (medium), with low impact on the confidentiality and integrity of the user's browser session rather than on the backup service itself. It affects organizations running the Enterprise Manager portal; the supplied data does not list vulnerable or fixed version ranges. A related headline also ties malicious script execution to Veeam Backup and Replication, but this CVE text names Enterprise Manager only. No public proof-of-concept is known and the CVE is not in CISA's KEV catalog, so exploitation is not known from this data.
What to do: Apply Veeam's fix for CVE-2025-64392 on Backup Enterprise Manager as soon as it is available for your build; the provided data does not name a fixed version. Until then, keep the portal off the public internet, restrict it to trusted admins, and treat unexpected links to the portal as hostile. Confirm the console is not exposed and review Veeam's advisory for the exact builds you run.
Affected
| Veeam Backup Enterprise Manager | — |
Estimated exposure
moderateOn the order of 1,000–10,000+ Enterprise Manager portals (estimate, not a measured count) — Estimate only: Veeam backup software is widely used in enterprises, but Enterprise Manager is an optional web portal on a subset of those deployments and no active-install or internet-scan count is in the data.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.