Loading vulnerability…
Authenticated Remote Code Execution in Veeam Backup & Replication Mount Service
CVE-2025-48983 is a critical unsafe deserialization vulnerability in the Mount service of Veeam Backup & Replication. An overly broad allowlist in the service's custom binary formatter permits gadget chains during deserialization of objects received through its .NET Remoting channel. An authenticated Active Directory domain user can submit a crafted serialized object to execute arbitrary code on affected backup infrastructure hosts with the privileges of the Mount service process. Affected releases include version 12.3.2.3617 and earlier version 12 builds in domain-joined deployments. Workgroup deployments, Veeam Software Appliance, and version 13 are not affected. The vulnerability has a CVSS 3.1 base score of 9.9.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of affected backup infrastructure hosts. Code execution under the Mount service account can enable access to data and resources available to that account, modification of backup infrastructure, and disruption of backup or recovery operations. The extent of compromise depends on the service account's privileges and accessible resources.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is identified. Pending patching, restrict network access to the Mount service and backup infrastructure to explicitly authorized systems and users, and apply Veeam security-hardening practices. Workgroup deployments are not affected, but access restrictions and deployment hardening should not be treated as substitutes for patching affected domain-joined systems.
Patch, then assume compromise.
Upgrade affected Veeam Backup & Replication installations to version 12.3.2.4165 or a later supported release containing the fix, following Veeam advisory KB4771. Back up configuration and data before updating, and verify the installed build and successful patch deployment afterward. Version 13 is not affected. Unsupported older product versions have not been confirmed safe and should be migrated to a supported, fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.