Arbitrary Code Execution Vulnerability in Veeam Backup & Replication
CVE-2025-64393

9.4CRITICAL

Key Information:

Vendor

Veeam
Status
Backup And Replication
Vendor
CVE Published:
7 October 2026

What is CVE-2025-64393?

A vulnerability in Veeam Backup & Replication enables a Backup Viewer to execute arbitrary code with SYSTEM-level privileges on the backup server. This flaw could allow attackers to compromise critical backup operations and access sensitive data, highlighting the importance of securing backup solutions to prevent unauthorized access and maintain data integrity.

Affected Version(s)

Backup and Replication 12 < 12.3.2.4934

References

https://www.veeam.com/KB4934

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nhien Pham (@nhienit) of Galaxy One
.