Loading vulnerability…
CVE-2025-64393 is an insecure deserialization vulnerability in Veeam Backup & Replication. Untrusted data received through the Mount Service allows an authenticated user with the low-privileged Backup Viewer role to execute arbitrary code remotely as SYSTEM on the backup server without additional user interaction. Version 12 builds through 12.3.2.4854 are affected. The vulnerability is fixed in version 12.3.2 P4, build 12.3.2.4934; version 13 builds are unaffected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Critical remote code execution vulnerability in Veeam Backup & Replication caused by deserialization of untrusted data from the Mount Service. An attacker with the Backup Viewer role can execute arbitrary code on the backup server. The article reports a CVSS v4 score of 9.4 and a fix in version 12.3.2.4934 (12.3.2 P4). Version 13 branches are not affected.
A critical remote code execution vulnerability affecting all Veeam Backup & Replication version 12 builds through 12.3.2.4854. Insecure deserialization through the Mount Service allows an authenticated attacker with the Backup Viewer role to execute code on the backup server, with low attack complexity and no user interaction. Its CVSS 4.0 score is 9.4. Compromise could enable credential theft, backup manipulation, or follow-on attacks; actual malware or ransomware use is not reported. The content reports no confirmed exploitation in the wild and no documented publicly validated proof of concept, rather than establishing that no exploit exists. Veeam released the fix on October 6, 2026, in version 12.3.2 P4, build 12.3.2.4934; version 13 is unaffected. Recommended mitigations include upgrading, removing unnecessary Backup Viewer assignments, segmenting backup infrastructure, restricting access, and monitoring authentication, Mount Service behavior, and unexpected process execution.
A vulnerability in Veeam Backup & Replication allows a user with the Backup Viewer role to execute arbitrary code with SYSTEM privileges on the backup server.
A vulnerability in Veeam Backup & Replication allows an authenticated user with the Backup Viewer role to execute arbitrary code with SYSTEM privileges on the backup server. The supplied CVSS v4.0 vector indicates network-based exploitation with low attack complexity, low privileges required, and no user interaction. The record assigns CWE-502, deserialization of untrusted data.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.