CVE-2025-64393: Critical Veeam Backup & Replication RCE Vulnerability

Veeam has released a security update addressing CVE-2025-64393, a critical remote code execution vulnerability in Veeam Backup & Replication. The flaw has received a CVSS 4.0 score of 9.4 and enables a low-privileged authenticated user with the Backup Viewer role to execute arbitrary code on the Veeam Backup Server.

The vulnerability stems from insecure deserialization of untrusted data processed through the Mount Service. Given the sensitive role backup infrastructure plays in enterprise environments, successful exploitation could provide attackers with a powerful foothold for accessing recovery infrastructure, credentials, and other critical resources.

The issue was addressed on October 6, 2026, with the release of Veeam Backup & Replication 12.3.2 P4, build 12.3.2.4934. All version 12 builds up to and including 12.3.2.4854 are affected, while Veeam Backup & Replication version 13 is not vulnerable.

Organizations can strengthen defenses against emerging vulnerability exploitation by leveraging SOC Prime’s AI-Native Detection Intelligence Platform. Security teams can access continuously updated detection content and apply detections across 40+ SIEM, EDR, and Data Lake technologies.

Security professionals can also use Uncoder AI to generate detection logic from threat intelligence, convert IOCs into hunting queries, refine existing rules, visualize attack flows, and translate detections across multiple security platforms.

Contact Sales

CVE-2025-64393 Analysis

CVE-2025-64393 affects Veeam Backup & Replication version 12.3.2.4854 and all earlier version 12 builds. According to Veeam, the vulnerability exists because untrusted data received through the Mount Service can be insecurely deserialized.

An attacker must already possess authenticated access and hold the Backup Viewer role. However, this role is relatively low privileged compared with administrative access, significantly increasing the security implications of the vulnerability. Successful exploitation can result in remote code execution directly on the Veeam Backup Server without requiring additional user interaction.

Deserialization vulnerabilities occur when an application reconstructs objects from attacker-controlled data without sufficiently validating that input. If specially crafted serialized data reaches a vulnerable processing component, an attacker may be able to manipulate application behavior and trigger unintended code execution.

In this case, the vulnerable attack surface is associated with the Veeam Mount Service. Since exploitation results in code execution on the backup server, attackers who already obtain a limited Veeam account could potentially use the flaw to escalate their access and compromise highly sensitive backup infrastructure.

The security implications are significant. Backup platforms commonly have broad access to production workloads, repositories, administrative infrastructure, and recovery data. Compromise of such systems can therefore increase the risk of credential theft, backup tampering, data destruction, or follow-on ransomware activity.

Veeam assigned the flaw a CVSS 4.0 score of 9.4, with low attack complexity and no user interaction required. The vulnerability was reported through HackerOne, although Veeam’s advisory does not disclose the exact original reporting date or identify the researcher.

At the time of writing, the vendor advisory and the referenced security reports do not indicate confirmed exploitation in the wild. They also do not document a publicly validated CVE-2025-64393 PoC. Nevertheless, once patches become available, attackers may attempt to reverse-engineer fixes and develop exploitation techniques against systems that remain unpatched.

For CVE-2025-64393 detection, defenders should prioritize monitoring authenticated activity involving Backup Viewer accounts, unusual Mount Service behavior, unexpected child processes originating from Veeam components, and suspicious command execution on backup servers.

CVE-2025-64393 Mitigation

Veeam addressed the vulnerability in Veeam Backup & Replication 12.3.2 P4, build 12.3.2.4934. Organizations using version 12 should upgrade vulnerable deployments to this build or a later supported release as soon as possible. Veeam confirms that version 13 builds are not affected by this vulnerability.

Administrators can verify the installed build from the Veeam Backup & Replication Console by navigating to Main Menu > Help > About. Systems running build 12.3.2.4854 or an earlier version 12 release should be considered affected until the security update is installed.

Organizations should also review which users currently hold the Backup Viewer role and revoke unnecessary assignments. Applying least-privilege principles is particularly important because exploitation does not require administrative permissions.

Backup infrastructure should additionally be segmented from ordinary production systems and protected with strong authentication, restricted administrative access, and dedicated monitoring. Security teams should investigate abnormal authentication attempts, unexpected service behavior, and suspicious process execution associated with Veeam components.

To Detect CVE-2025-64393 exploitation attempts, defenders can correlate Backup Viewer authentication events with abnormal Mount Service activity and subsequent process creation or command execution on the Veeam Backup Server.

No attack-specific CVE-2025-64393 IOCs have been published in the vendor advisory referenced at the time of writing. Behavioral monitoring is therefore especially important for identifying suspicious activity that may indicate attempted or successful exploitation.

SOC Prime’s AI-Native Detection Intelligence Platform enables security teams to accelerate threat hunting and detection engineering for emerging vulnerabilities while maintaining detection coverage across diverse security environments.