Loading vulnerability…
Authenticated Remote Code Execution in Veeam Backup & Replication Backup Server
CVE-2025-48984 is a critical remote code execution vulnerability in the Backup Server component of Veeam Backup & Replication. It allows an authenticated domain user to execute arbitrary code remotely on a domain-joined backup server. The vulnerability is associated with unsafe deserialization, although the specific vulnerable function and exploitation mechanism are not established. Affected releases include version 12.3.2.3617 and earlier version 12 builds. Unsupported versions may also be affected but have not been tested. The vulnerability has a CVSS score of 9.9.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution on the Backup Server, potentially compromising backup operations and the confidentiality, integrity, and availability of data accessible to the compromised process. The execution privilege level is not established.
If you can’t patch tonight, do this now.
Follow Veeam's security-hardening and implementation best practices. No vulnerability-specific temporary workaround is established; hardening should not be treated as a substitute for applying the security update.
Patch, then assume compromise.
Upgrade Veeam Backup & Replication to version 12.3.2.4165, which fixes CVE-2025-48984, or a subsequent supported release containing the fix. Follow Veeam advisory KB4771 and applicable upgrade guidance. Back up configuration and data before updating, and verify the installed build afterward.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.