Loading story…
A critical vulnerability, tracked as CVE-2025-64113, was discovered in Emby Server versions below 4.9.1.81, allowing remote attackers to gain full administrative access to the server without any authentication or preconditions beyond network access. The flaw enables attackers to take over Emby Server administration, though it does not provide operating system-level access. The issue has been addressed in version 4.9.1.81, and users are strongly advised to update to this version to mitigate the risk.
Security advisories highlight the severity of this vulnerability, with a CVSS 4.0 score of 9.3, categorizing it as critical. The vulnerability does not require any user interaction or prior knowledge of credentials, making unpatched servers highly susceptible to compromise. Organizations and individuals running affected Emby Server versions should prioritize patching to prevent unauthorized administrative control.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A public advisory disclosed CVE-2025-64113 as a critical Emby Server vulnerability enabling unauthenticated administrative takeover over the network. The flaw was published with a CVSS v4.0 score of 9.3 and linked to GitHub Security Advisory GHSA-95fv-5gfj-2r84.
Emby Server version 4.9.1.81 was released with a fix for CVE-2025-64113, a critical flaw that could let a remote attacker gain full administrative access without authentication. The issue affects versions prior to 4.9.1.81.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Veeam released a security advisory disclosing multiple vulnerabilities in its Veeam Backup & Replication and Veeam Agent for Microsoft Windows products. Two of the vulnerabilities, CVE-2025-48983 and CVE-2025-48984, were rated as critical with a CVSS score of 9.9, indicating a severe risk to affected systems. Both critical vulnerabilities reside in the Veeam Backup & Replication product and allow an authenticated domain user to execute arbitrary code on backup infrastructure hosts and the backup server, respectively. These flaws specifically impact Veeam Backup & Replication version 12.3.2.3617 and all earlier version 12 builds, but only on domain-joined backup servers. A third vulnerability, CVE-2025-48982, affects Veeam Agent for Microsoft Windows and allows for local privilege escalation if a system administrator is tricked into restoring a malicious file. This vulnerability impacts version 6.3.2.1205 and all earlier version 6 builds of the agent. The vendor has indicated that unsupported product versions have not been tested but are likely vulnerable and should be considered at risk. The vulnerabilities were disclosed on October 14, 2025, and security advisories were published the following day to alert users and administrators. CERT-EU and other security organizations have strongly recommended that organizations update affected software immediately to mitigate the risk of exploitation. In addition to patching, following Veeam's implementation best practices is advised to further reduce exposure. The vulnerabilities require an authenticated domain user for exploitation, which means that attackers would need valid credentials or access to a compromised account within the target environment. The potential impact of successful exploitation includes full remote code execution on critical backup infrastructure, which could lead to data theft, ransomware deployment, or destruction of backup data. The disclosure has raised concerns in the security community due to the critical nature of backup systems in organizational resilience and recovery. Security advisories have emphasized the urgency of remediation, given the high CVSS scores and the potential for significant operational disruption. Organizations are also advised to review their backup server configurations and restrict access to trusted users only. The vendor has provided detailed guidance and best practices for hardening Veeam deployments, including recommendations for both workgroup and domain-joined environments. The vulnerabilities highlight the ongoing risks associated with backup infrastructure and the importance of timely patch management. Security teams are urged to monitor for signs of exploitation and to ensure that all backup-related systems are included in vulnerability management programs. The incident underscores the need for layered security controls and regular review of privileged access within enterprise environments.
Jun 29, 2026
Veeam released security updates for multiple products, led by a **critical authentication bypass** in **Veeam Backup Enterprise Manager** tracked as `CVE-2024-29849`. The flaw allows an unauthenticated attacker to log in as any user, including an administrator, by supplying a forged VMware SSO token to the REST API service on TCP port `9398`. Veeam also addressed related Enterprise Manager issues including `CVE-2024-29850`, which can enable account takeover through **NTLM relay**, `CVE-2024-29851`, which can expose the NTLM hash of the Enterprise Manager service account, and `CVE-2024-29852`. The updates extend beyond Enterprise Manager. Veeam patched **Backup & Replication**, **Veeam Agent for Windows**, and **Veeam Service Provider Console**, including `CVE-2024-29212`, a critical remote code execution flaw in Service Provider Console, and `CVE-2024-29853`, a local privilege escalation issue in Agent for Windows. Veeam advised organizations to upgrade immediately, including moving Backup & Replication to at least **12.1.2.172** and Veeam Agent for Windows to at least **6.1.2**; where Enterprise Manager cannot be patched promptly, the company recommended stopping the Backup Enterprise Manager service as a temporary mitigation.
Aug 1, 2026
A critical vulnerability identified as CVE-2025-52691 has been discovered in SmarterMail, allowing unauthenticated attackers to upload arbitrary files to any location on the mail server. This flaw, rated with a CVSS score of 10, enables remote code execution, potentially giving attackers full control over affected servers. The vulnerability can be exploited without authentication, significantly increasing the risk of compromise for organizations running vulnerable versions of SmarterMail. Security advisories emphasize the severity of this issue, warning that successful exploitation could lead to the deployment of web shells or other malicious payloads, facilitating further attacks or persistent access. Organizations using SmarterMail are urged to apply available patches immediately and review server logs for signs of unauthorized file uploads or suspicious activity.
Jun 29, 2026