Veeam fixed critical Backup & Replication flaw CVE-2025
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-23120 | Domain-User RCE via Deserialization in Veeam Backup & Replication Veeam Backup & Replication contains a deserialization of untrusted data flaw (CWE-502) that allows remote code execution. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N), the attack is network-reachable, straightforward to execute, and requires only low-privilege credentials — a regular domain user — with no user interaction; the vendor description states it yields RCE 'for domain users'. An attacker who obtains or already holds any domain-user account that can reach the backup server gains code execution with high confidentiality, integrity and availability impact, a foothold that is especially dangerous in backup infrastructure because those servers often hold credentials for large parts of the estate and are prime ransomware targets. Any organization running Veeam Backup & Replication is potentially affected. Veeam has released a fix (reported alongside its patch for the related CVE-2025-23121, rated 9.9, in the same product); a public technical write-up/PoC from watchTowr exists, the flaw is not yet in CISA's KEV, and EPSS assigns a 24% probability (98th percentile) of exploitation within 30 days. Do: Upgrade Veeam Backup & Replication to the patched release specified in Veeam's security advisory; if you already applied the fix for the related CVE-2025-23121 (CVSS 9.9), verify you are on the newest build, as this flaw was disclosed alongside that patch. Restrict network access to backup infrastructure, review which domain accounts can reach the B&R server, and monitor for exploitation attempts given the public PoC and elevated EPSS score. | 8.8 | 24% | PoC |
| large≈ hundreds of thousands of enterprise installations (Veeam's flagship product; Veeam has publicly reported 550,000+ customers) |
Full article289 words · extracted from securityaffairs.com · click to collapse
Veeam released security patches for a critical Backup & Replication vulnerability that could let attackers remotely execute code.
Veeam addressed a critical security vulnerability, tracked as CVE-2025-23120 (CVSS score of 9.9), impacting its Backup & Replication software that could lead to remote code execution.
The vulnerability impacts 12.3.0.310 and all earlier version 12 builds, it was fixed with the release of version 12.3.1 (build 12.3.1.1139).
“A vulnerability allowing remote code execution (RCE) by authenticated domain users.” reads the advisory published by the company.
Security researcher Piotr Bazydlo of watchTowr reported the vulnerability. The vulnerability arises from a flawed deserialization handling implemented by Veeam, allowing attackers to bypass its blocklist and exploit missing gadgets to achieve remote code execution.
“This research would never happen if not for my colleague Sina. He insisted that I should have a look at the Veeam deserialization mechanism, and I would have never done this if not him.” wrote watchTowr. “He has also provided me all the knowledge needed for the exploitation, thus I only needed to focus on an easy stuff – gadget discovery.”
Any local user on the Veeam server, or any domain user if the server is domain-joined, can exploit the vulnerability.
Veeam’s patch blocks the identified gadgets, but similar risks remain if new deserialization gadgets are found.
“Given the size of the Veeam codebase, we wouldn’t be surprised if other researchers now find numerous further feasible deserialization gadgets.” concludes watchTowr. “It is hard for us to be positive about this, given the criticality of the solution, combined with the well-known and trodden ground of this solution being targeted by ransomware gangs.”
Backup & Replication
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Veeam)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/175674/slider/veeam-critical-backup-replication-vulnerability.html