Veeam fixes four Backup and Replication flaws including critical RCE

Veeam’s October 6 update 12.3.2 P4 fixes four Backup & Replication flaws, including critical RCE CVE-2025-64393.

Veeam released Backup & Replication 12.3.2 P4, build 12.3.2.4934, on October 6, 2026, fixing four vulnerabilities with CVSS 4.0 scores from 4.8 to 9.4. The most severe, CVE-2025-64393 (CVSS 9.4), lets a low-privileged Backup Viewer achieve remote code execution on the backup server through insecure deserialization in the Mount Service without user interaction; GBHackers says it affects version 12 builds through 12.3.2.4854 and that version 13 is not affected. The same update also addresses CVE-2026-58069 (CVSS 8.3), an authenticated Cloud Connect tenant arbitrary file read; CVE-2026-93026 (CVSS 6.1), which lets a Backup Viewer modify the master key and antivirus update credentials; and CVE-2025-64392 (CVSS 4.8), reflected XSS in Enterprise Manager. Sources disagree on version 13: Cyber Security News says version 13 is unaffected by the XSS but that CVE-2026-58069 also affects specified version 13 builds, while Canada’s Cyber Centre advisory AV26-1009 lists builds before 12.3.2.P4, 13.03, and 13.1 as affected without naming CVEs. None of the reports confirm in-the-wild exploitation; Cyber Security News says Veeam warns unpatched systems could be targeted after patch analysis, and GBHackers notes Veeam published no exploit code. The Canadian bulletin, issued October 7, 2026, directs administrators to Veeam KB4934 and urges them to apply available updates.

• Veeam released Backup & Replication 12.3.2 P4, build 12.3.2.4934, on October 6, 2026, fixing four flaws scored CVSS 4.0 from 4.8 to 9.4.
• CVE-2025-64393 (CVSS 9.4) lets a low-privileged Backup Viewer achieve remote code execution on the backup server through insecure deserialization in the Mount Service, without user interaction.
• GBHackers says that RCE affects version 12 builds through 12.3.2.4854 and that version 13 is not affected.
• CVE-2026-58069 (CVSS 8.3) lets an authenticated Cloud Connect tenant read arbitrary files; Cyber Security News says it also affects specified version 13 builds.
• CVE-2026-93026 (CVSS 6.1) lets a Backup Viewer modify the master key and antivirus update credentials; CVE-2025-64392 (CVSS 4.8) is reflected XSS in Enterprise Manager, and Cyber Security News says version 13 is unaffected by the XSS.
• Canadian Centre for Cyber Security advisory AV26-1009 (October 7, 2026) lists builds before 12.3.2.P4, 13.03, and 13.1 as affected, names no CVEs, and points administrators to Veeam KB4934.
• No source confirms in-the-wild exploitation; GBHackers says Veeam published no exploit code, and Cyber Security News says Veeam warns unpatched systems could be targeted after patch analysis.