CriticalCVECVE-2025-64392
Veeam Backup and Replication Vulnerability Allow Attackers to Execute Malicious Script
Cyber Security News·Source published ·1 min read
What happened?
Veeam has released Veeam Backup & Replication 12.3.2 P4, build 12.3.2.4934, to address four security vulnerabilities, including a flaw that lets attackers execute malicious scripts in an authenticated user’s browser. Released on October 6, 2026, the update also fixes a critical remote code execution vulnerability affecting the backup server. The vulnerabilities carry CVSS 4.0 scores ranging from 4.8 to 9.4. They involve browser script execution, insecure deserialization, unauthorized access to sensitive configuration data, and arbitrary file reading.
Key details
- Veeam released build 12.3.2.4934 fixing four vulnerabilities, including browser script execution.
- A low‑privileged Backup Viewer can trigger insecure deserialization for remote code execution on the backup server.
- A reflected XSS requires an authenticated portal user to open a crafted link.
- CVE‑2026‑58069 lets an authenticated Cloud Connect tenant read arbitrary files on the provider host.
- CVE‑2026‑93026 permits a Backup Viewer to modify the master key and overwrite antivirus credentials.
- Enterprise Manager build 12.3.2.4854 and earlier 12.x builds are affected; version 13 is not.
Affected
- Enterprise Manager build 12.3.2.4854 and earlier version 12 builds are affected.
- Backup Server builds 12.3.2.4854 and earlier 12.3 builds are affected.
- Specified version 13 builds are affected by CVE‑2026‑58069.
What to look for
- Attack needs an authenticated portal user to click a malicious link.
- Low‑privileged Backup Viewer can exploit insecure deserialization without admin rights.
- Authenticated Cloud Connect tenant can read arbitrary files on the service provider host.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.