Critical RCE Flaws CVE-2025-48983 & CVE-2025-48984 (CVSS 9.9) Found in Veeam Backup & Replication

According to Veeam’s advisory, two critical Remote Code Execution flaws, CVE-2025-48983 and CVE-2025-48984, carry a CVSS score of 9.9 and affect Veeam Backup & Replication. The issues allow an authenticated domain user to execute arbitrary code on vulnerable backup infrastructure hosts (CVE-2025-48983) and a domain user with network access to achieve RCE (CVE-2025-48984), with both targeting the Mount service and the Backup Server component, respectively.

The vulnerabilities affect Veeam Backup & Replication 12.3.2.3617 and all earlier 12 builds but are limited to domain-joined servers, with newer architectures immune. Veeam states that the Veeam Software Appliance and Backup & Replication v13 are not impacted.

Both flaws have been resolved in the latest build, Veeam Backup & Replication 12.3.2.4165 Patch, which users are urged to deploy immediately; a separate high-severity issue, CVE-2025-48982, affects Veeam Agent for Microsoft Windows and is fixed in version 6.3.2.1302.