Veeam Backup & Replication: Remote code execution via insecure deserialization
Summary
A low-privileged user with the Backup Viewer role can send untrusted data to the Mount Service of Veeam Backup & Replication 12 and execute code as SYSTEM on the backup server. The flaw is rated critical (CVSS v4.0 9.4) and requires a valid Backup Viewer account. Version 13 is not affected according to Veeam.
Affected
- Veeam Backup & Replication 12.3.2.4854 and all earlier version 12 builds
- Version 13 is not affected
Fixed in
- Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934)
Workaround
Unknown. Veeam does not list a workaround in KB4934.
Exploitation
- No confirmed in-the-wild exploitation reported by Veeam
- No public proof of concept confirmed in the sources reviewed
- CISA SSVC: Exploitation none, Automatable no
Our recommendation
- Confirm the installed build on all Veeam Backup & Replication servers and upgrade version 12 systems to 12.3.2 P4 (build 12.3.2.4934) after a configuration backup
- Review and reduce Backup Viewer assignments and restrict console access to management networks
- Review logs for unusual Backup Viewer logons and unexpected child processes on the backup server
- If Enterprise Manager is deployed, update it before Backup & Replication
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Veeam KB4934 www.veeam.com
- OpenCVE CVE-2025-64393 app.opencve.io
- Secure-ISS: Veeam Backup & Replication remote code execution www.secure-iss.com
- SOCPrime: CVE-2025-64393 analysis socprime.com
- Canadian Centre for Cyber Security: AV26-1009 www.cyber.gc.ca
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:12.
Original description (NVD)
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.