Critical Veeam Backup RCE Flaws Allow Remote Execution of Malicious Code

Veeam has released an urgent security patch to address multiple critical remote code execution vulnerabilities in Veeam Backup & Replication version 12. Two of the most severe flaws affect domain-joined installations, with CVE-2025-48983 enabling an authenticated domain user to execute arbitrary code remotely via the Mount service on backup infrastructure hosts (CVSS v3.1 9.9), and CVE-2025-48984 allowing RCE on the primary backup server by an authenticated domain user (CVSS 3.1 9.9).

Both issues were reported by external researchers CODE WHITE for CVE-2025-48983, and Sina Kheirkhah (@SinSinology) alongside Piotr Bazydlo (@chudyPB) of watchTowr for CVE-2025-48984. A high-severity local privilege escalation vulnerability exists in Veeam Agent for Microsoft Windows, CVE-2025-48982, which can be triggered when an administrator restores a maliciously crafted file (CVSS 3.1 7.3).

All three vulnerabilities are addressed in the Veeam Backup & Replication 12.3.2.4165 patch and the Veeam Agent for Windows 6.3.2.1302 update, with organisations urged to install the latest builds immediately and verify that backup servers and infrastructure hosts run the updated software.