This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Veeam Backup & Replication fixes 3 vulnerabilities
Veeam Backup & Replication version 12.3.2.4934 fixes 3 vulnerabilities, one of them critical [1].
An authenticated attacker with low privileges (Backup Viewer role) can execute arbitrary code due to unsafe deserialization of untrusted data received via the Mount Service [1].
The vulnerability is present in product:
- Veeam Backup & Replication; >=12, <12.3.2.4934
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
More information:
- CVE-2025-64393 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 6. 10. 2026.
An authenticated attacker with the low-privileged Backup Viewer role can modify or delete the Enterprise Manager master key and read or overwrite stored credentials for antivirus updates [1].
The vulnerability is present in product:
- Veeam Backup & Replication; >=12, <12.3.2.4934
CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
More information:
- CVE-2026-93026 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 6. 10. 2026.
An unauthenticated remote attacker can carry out an XSS attack against an authenticated portal user by means of a specially crafted link, due to insufficient input sanitization [1].
The vulnerability is present in product:
- Veeam Backup Enterprise Manager; >=12, <12.3.2.4934
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
More information:
- CVE-2025-64392 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 6. 10. 2026.
Links
By CESNET, z.s.p.o. Henrieta Paločková on 7. 10. 2026.