Veeam fixes 3 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Veeam fixes 3 vulnerabilities

Veeam fixes three vulnerabilities in its products [1]. Products and their fixed versions: Veeam Backup & Replication - 12.3.2 (build 12.3.2.3617) Veeam Agent for Microsoft Windows - 6.3.2 (build 6.3.2.1205)

Veeam Backup & Replication - RCE (CVE-2025-23121)

CVSS 9.9 (Critical)

An authenticated remote attacker with a domain account can execute code on the Backup Server [1].

The vulnerability is present in product:

Veeam Backup & Replication; >=12.0.0.1402, <=12.3.1.1139;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

CVE-2025-23121 at cve.org, NVD

The vulnerability was publicly disclosed 17. 6. 2025.

Veeam Backup & Replication - RCE (CVE-2025-24286)

CVSS 7.2 (High)

An authenticated remote attacker with the Backup Operator role can modify backup jobs and potentially execute code [1].

The vulnerability is present in product:

Veeam Backup & Replication; >=12.0.0.1402, <=12.3.1.1139;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2025-24286 at cve.org, NVD

The vulnerability was publicly disclosed 17. 6. 2025.

Veeam Agent for Microsoft Windows - privilege escalation, RCE (CVE-2025-24287)

CVSS 6.1 (Medium)

An authenticated local attacker can modify the contents of directories in Veeam Agent for Microsoft Windows (standalone or as part of Veeam Backup & Replication), which may lead to code execution with elevated privileges [1].

The vulnerability is present in product:

Veeam Agent (Microsoft Windows); >=6.0.0.959, <=6.3.1.1074;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

More information:

CVE-2025-24287 at cve.org, NVD

The vulnerability was publicly disclosed 17. 6. 2025.

Report feedback

[TLP:CLEAR] Veeam fixes 3 vulnerabilities

Veeam Backup & Replication - RCE (CVE-2025-23121)

CVSS 9.9 (Critical)

Veeam Backup & Replication - RCE (CVE-2025-24286)

CVSS 7.2 (High)

Veeam Agent for Microsoft Windows - privilege escalation, RCE (CVE-2025-24287)

CVSS 6.1 (Medium)

Links