Loading story…
Veeam released Backup & Replication 12.3.2 P4, build 12.3.2.4934, to fix four vulnerabilities, including CVE-2025-64393, a critical remote code execution flaw rated CVSS 4.0 9.4. Insecure deserialization in the Mount Service allows an authenticated user with the low-privileged Backup Viewer role to execute arbitrary code as SYSTEM on the backup server, without user interaction. The flaw affects version 12 builds through 12.3.2.4854; version 13 is unaffected by this specific vulnerability. The other fixes address reflected cross-site scripting in Enterprise Manager, arbitrary file reading by Cloud Connect tenants, and unauthorized access to or modification of sensitive configuration data.
The Canadian Centre for Cyber Security urged administrators to review Veeam advisory KB4934 and apply relevant updates. Organizations running affected version 12 deployments should prioritize upgrading to build 12.3.2.4934, restrict Backup Viewer assignments, segment backup infrastructure, and monitor authentication, Mount Service activity, and unexpected process execution. CVE-2026-58069 also affects specified version 13 builds and requires separate fixes, so the version 12 patch does not resolve every affected deployment. The supplied reports identify no confirmed exploitation in the wild, publicly validated proof of concept, or attack-specific indicators of compromise for CVE-2025-64393, but backup-server compromise could enable credential theft, backup manipulation, data destruction, and follow-on ransomware activity.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
The remote code execution vulnerability was reported to Veeam through HackerOne. The vendor advisory did not identify the researcher or disclose the discovery or original reporting date.
The Canadian Centre for Cyber Security issued an advisory listing affected Veeam Backup & Replication versions as prior to 12.3.2.P4, 13.03, and 13.1. It directed users and administrators to review Veeam's support information and apply necessary updates as they become available.
The vulnerability history recorded receipt of CVE-2025-64393 by support@hackerone.com. The record describes arbitrary code execution as SYSTEM by a Backup Viewer user, classifies the flaw as CWE-502, and references Veeam advisory KB4934.
Veeam released build 12.3.2.4934 to address four vulnerabilities, including CVE-2025-64393, a critical Mount Service deserialization flaw allowing a Backup Viewer user to execute arbitrary code on the backup server without user interaction. The update also addresses reflected cross-site scripting, arbitrary file reading, and unauthorized access to or modification of sensitive configuration data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcesocprime.com
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Veeam** released security updates for **Backup & Replication** to address multiple high-severity flaws, including several **remote code execution** issues affecting version `12.3.2.4165` and all earlier version 12 builds. The disclosed vulnerabilities include `CVE-2026-21666`, `CVE-2026-21667`, `CVE-2026-21668`, `CVE-2026-21672`, and `CVE-2026-21708`, with several carrying **CVSS 9.9** ratings. According to the advisories, successful exploitation could allow authenticated domain users to execute code on the backup server, manipulate arbitrary files on a backup repository, or achieve local privilege escalation on Windows-based servers. Veeam said the issues were fixed in **Backup & Replication** version `12.3.2.4465`, while `CVE-2026-21672` and `CVE-2026-21708` were also remediated in version `13.0.1.2067`, alongside additional critical flaws `CVE-2026-21669` and `CVE-2026-21671`. The company warned that public patch disclosure increases the likelihood of **patch reverse engineering** and follow-on attacks against unpatched systems, making rapid remediation a priority for organizations running exposed or domain-connected Veeam infrastructure.
Mar 13, 2026
**Veeam** released security updates for *Veeam Backup & Replication (VBR)* addressing multiple vulnerabilities, including **four critical remote code execution (RCE) flaws** that could allow code execution on backup servers under certain access conditions. Reported issues include RCE paths for low-privileged domain users (CVE-2026-21666, CVE-2026-21667, CVE-2026-21669) and an additional RCE scenario where a Backup Viewer could achieve code execution as the `postgres` user (CVE-2026-21708). Veeam also fixed several high-severity issues enabling actions such as privilege escalation on Windows-based VBR servers, extraction of saved SSH credentials, and bypassing restrictions to manipulate arbitrary files on a Backup Repository. The Canadian Centre for Cyber Security relayed Veeam’s advisory and urged organizations to apply updates, noting affected branches as VBR 12 and 13 prior to fixed releases. Veeam’s fixes are available in **Veeam Backup & Replication 12.3.2.4465** and **13.0.1.2067**, and the vendor warned that attackers commonly reverse-engineer patches shortly after release to target unpatched deployments—an elevated concern given VBR’s frequent targeting in ransomware operations. Other Canadian Centre advisories in the same period covered unrelated vendor updates (e.g., ABB, GitHub, Splunk, JetBrains, Hitachi, VMware, Fortinet, Mozilla) and do not describe the Veeam RCE issue.
Mar 12, 2026
Veeam Software disclosed and patched four critical vulnerabilities in its Backup & Replication v13 product, including a remote code execution (RCE) flaw rated CVSS 9.0 (CVE-2025-59470) that allows Backup or Tape Operators to execute arbitrary code as the PostgreSQL user by abusing interval or order parameters. Additional vulnerabilities include CVE-2025-55125, which enables RCE as root via a malicious backup configuration file, CVE-2025-59468 for RCE as the PostgreSQL user through a password parameter, and CVE-2025-59469 for arbitrary file write as root. These flaws were discovered during internal testing and have been addressed in build 13.0.1.1071, with Veeam urging immediate upgrades to mitigate risk. The vulnerabilities specifically affect Veeam Backup & Replication v13.0.1.180 and earlier v13 builds, while versions 12.x and older are not impacted. Veeam highlighted that the affected operator roles are highly privileged, and following security guidelines can reduce exploitability, which led to some severity downgrades. There is currently no evidence of exploitation in the wild, but the risk of attackers reverse-engineering patches to target unpatched systems is significant. Organizations are advised to update promptly and restrict operator role assignments to trusted personnel to minimize exposure.
Jan 7, 2026