Critical RCE Flaws in Veeam Backup & Replication and Rsync Require Patching

Authorities warned of critical vulnerabilities in two widely used backup and file synchronization products, with the most severe issues enabling remote code execution. In Veeam Backup & Replication version 12.3.1.1139 and all earlier 12.x releases, CVE-2025-23121 can allow code execution on a backup server when an authenticated domain user account is available, particularly on domain-joined systems. Two additional Veeam flaws, CVE-2025-24286 and CVE-2025-24287, can also lead to arbitrary code execution through backup job modification by an authenticated backup operator or by manipulating local directory contents as a local system user.

A separate alert covered Rsync version 3.3.0 and earlier, where six server-side vulnerabilities were disclosed. The most critical, CVE-2024-12084, can allow arbitrary code execution on a target Rsync server, while additional flaws include CVE-2024-12085, CVE-2024-12747, CVE-2024-12086, CVE-2024-12087, and CVE-2024-12088; the client application is not affected. Defenders were urged to apply vendor fixes immediately, including upgrading Veeam to version 12.3.2 build 12.3.2.3617 and installing patched Rsync packages provided by Linux distributors.