Veeam RCE Exploit Allegedly Listed for Sale on Dark Web

A new dark web marketplace listing has sparked alarm in the cybersecurity community after a seller using the handle “SebastianPereiro” purportedly advertised a remote code execution exploit targeting Veeam Backup & Replication platforms. The alleged exploit, marketed as the “Bug of June 2025,” is claimed to affect certain versions of the Veeam 12.x series, specifically builds 12.1, 12.2, 12.3, and 12.3.1.

According to the advertisement, the flaw centres on systems integrated with Active Directory, meaning exploitation requires access to any legitimate Active Directory credential. The listing stated that no public code or proof-of-concept exists for this vulnerability, and the seller asked for $7,000 with all inquiries to be conducted via private messages for “reviewers” only.

A warning note indicated that attempts to use the exploit without an appropriate Active Directory account would fail, and no technical details about the underlying vulnerability were disclosed. As of late September 2025, Veeam has not released an advisory addressing CVE-2025-23121, and defenders are urged to monitor for unusual authentication attempts and privileged activity on systems integrated with Active Directory and Veeam.