Loading vulnerability…
CVE-2025-64392 is a reflected cross-site scripting vulnerability in Veeam Backup Enterprise Manager. An attacker can craft a link that executes attacker-controlled script in the browser of an authenticated portal user who opens it. The vulnerability affects version 12 builds through 12.3.2.4854 and is fixed in 12.3.2 P4, build 12.3.2.4934. Version 13 builds are unaffected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Reflected cross-site scripting vulnerability in Veeam Backup Enterprise Manager. An attacker can execute script code in an authenticated portal user's context by enticing the user to click a crafted link. The article reports a CVSS v4 score of 4.8 and a fix in the 12.3.2.4934 (12.3.2 P4) release. Version 13 branches are not affected.
A vulnerability in Veeam Backup Enterprise Manager that allows attacker-controlled script execution in a portal user's browser when the user opens a crafted link. Exploitation requires user interaction.
A reflected cross-site scripting vulnerability in Veeam Backup Enterprise Manager, rated medium with a CVSS 4.0 score of 4.8. Exploitation requires an authenticated portal user to open a malicious link and executes scripts in that user's browser, not on the backup server. Enterprise Manager build 12.3.2.4854 and earlier version 12 builds are affected; version 13 is not affected. The fix is included in build 12.3.2.4934.
A reflected cross-site scripting vulnerability in Veeam Backup Enterprise Manager enables script execution in an authenticated user's browser when the user opens a crafted link. The advisory identifies Veeam Backup and Replication versions before 12.3.2 as affected and recommends upgrading to version 12.3.2 or later. Severity is Medium, with CVSS v3 score 6.1 and CVSS v4 score 4.8. Nessus detects exposure using the application's self-reported version rather than testing exploitation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.