Veeam Backup & Replication Vulnerability CVE-2025-64393: RCE via the Backup Viewer Role

Summary

On 6 October 2026 Veeam published KB4934, listing three vulnerabilities fixed in Veeam Backup & Replication 12.3.2 P4. The most serious is Veeam Backup & Replication vulnerability CVE-2025-64393. It lets a low-privileged user who holds only the Backup Viewer role run code remotely (RCE) on the backup server. The cause is insecure deserialization of untrusted data received through the Mount Service. According to the CVE record, the code runs as SYSTEM.

• CVSS v4.0: 9.4 (Critical)
• Affected versions: Veeam Backup & Replication 12.3.2.4854 (12.3.2 P3) and all earlier version 12 builds.
• Not affected: All Veeam Backup & Replication version 13 builds.
• Actively exploited: Veeam's article does not mention exploitation. As of 8 October 2026 we have seen no public reports of exploitation, and the flaw is not in the CISA KEV catalog.
• Remediation status: Patch available: 12.3.2 P4 (build 12.3.2.4934).

Vulnerabilities fixed in the same update

All three affect the same builds and are fixed in 12.3.2.4934. All were reported through HackerOne.

Why it matters

Backup servers are a priority target for ransomware operators. An attacker who deletes or encrypts the backups also removes the way back. Here the attacker does not need admin rights; an account with the Backup Viewer role, which is meant for monitoring, is enough. A single compromised or weakly protected viewer account can turn into control of the whole backup infrastructure.

Veeam itself warns that once a patch is disclosed, attackers will likely reverse-engineer it to target unpatched installations.

What to do now

1. Check your build: Look up the build number in the Veeam Backup & Replication console. If you run a version 12 build older than 12.3.2.4934, you are affected.
2. Update to 12.3.2.4934: Take a configuration backup first. If Enterprise Manager runs on a separate server, update it as well.
3. Restrict the Backup Viewer role: In the console, go to Users & Roles > Security, list who holds this role and remove accounts that do not need it. Grant it to named people, not broad groups.
4. Enable MFA on the console: Veeam Backup & Replication supports multi-factor authentication for remote console and web UI logins. MFA does not work for user groups, so add users individually. It is not available in Community Edition, and Enterprise Manager supports MFA only through a third-party identity provider connected via SAML.
5. Take the backup server out of the domain: Do not join the Veeam server to your production Active Directory domain. Keep it in a separate management environment and restrict admin access to a dedicated network segment.
6. Keep immutable and offline copies: Store at least one copy of your backups on immutable storage, such as a hardened Linux repository or object storage with Object Lock, or offline. Test restores regularly.
7. Look for traces: Review the backup server for unexpected accounts, new role assignments, deleted or modified backup jobs and changes to the Enterprise Manager key.
8. Plan for the end of version 12: Veeam Backup & Replication 12 reaches end of support on 28 February 2027. Start planning the move to version 13 now.

How can Doğa Network help?

Our team can help with Veeam Backup & Replication build checks and planned updates, role and permission reviews, console MFA, moving the backup server out of the domain, setting up immutable backup repositories and planning the move to version 13. Call us on +90 850 888 3642 or email hi@doga.network.

Sources

• Veeam – KB4934: Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4
• Veeam – KB4696: Release Information for Veeam Backup & Replication 12.3
• CVE.org – CVE-2025-64393
• Veeam Help Center – Multi-Factor Authentication