A remote code execution (RCE) vulnerability in Veeam Backup & Replication could allow any domain user to compromise backup servers with SYSTEM-level privileges. The findings, assigned CVE-2025-23120, affect Veeam Backup & Replication 12.3.0.310 and all earlier version 12 builds, demonstrating how blacklist-based security mechanisms continue to fail in enterprise environments. Most concerning is the authentication barrier – any user belonging to the local Users group on a Windows host running Veeam, or any domain user if the server is joined to Active Directory, can exploit these vulnerabilities. According to watchTowr Labs Report, the vulnerabilities leverage flawed deserialization mechanisms within Veeam’s backup solution, allowing attackers to escalate privileges and potentially compromise critical backup infrastructure. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This vulnerability highlights the ongoing challenge in secure software design, particularly in backup solutions that have become primary targets for ransomware operators seeking to disable recovery capabilities. The second vulnerability (WT-2025-0015) similarly abuses the Veeam.Backup.Core.BackupSummary class, which also extends the DataSet class known for RCE capabilities. In domain-joined environments, all domain users are automatically added to this group, making this vulnerability exploitable by any domain user. Kaaviya is a Security Editor and fellow reporter with Cyber Security News.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 21 Mar 2025 12:55:20 +0000