What is the CVSS score of CVE-2025-23121?

CVE-2025-23121 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Veeam Backup Replication are affected by CVE-2025-23121?

A high-severity vulnerability in our Backup Server allows authenticated domain users to execute arbitrary code remotely, potentially compromising our entire backup infrastructure and enabling data…. A patch is available.

How to fix or mitigate CVE-2025-23121?

Within 24 hours: Inventory all Backup Servers, verify patch availability for your version, and assess current user access controls to the backup environment. Within 7 days: Apply the available vendor patch to all affected Backup Servers during a planned maintenance window with appropriate backups. Within 30 days: Conduct post-patch validation, review domain user access to backup systems, and implement principle of least privilege to restrict authentication to backup infrastructure.

Veeam Backup Replication CVE-2025-23121

EUVD-2025-18675 HIGH

Code Injection (CWE-94)

2025-06-19 support@hackerone.com

Authentication Bypass RCE Veeam Backup Replication Veeam

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 00:08 euvd

EUVD-2025-18675

Analysis Generated

Mar 15, 2026 - 00:08 vuln.today

Patch released

Mar 15, 2026 - 00:08 nvd

Patch available

CVE Published

Jun 19, 2025 - 00:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user

AnalysisAI

Remote code execution vulnerability in Backup Server that allows authenticated domain users to execute arbitrary code with high severity (CVSS 8.8). The vulnerability requires valid domain credentials but no user interaction, making it a significant risk for organizations with Backup Server deployments in Active Directory environments. If actively exploited or with public POC availability, this represents an immediate priority for patching.

Technical ContextAI

This vulnerability is rooted in CWE-94 (Improper Control of Generation of Code), which indicates improper input validation or unsafe code generation/execution mechanisms within the Backup Server's code path. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates the vulnerability is exploitable over the network (AV:N) with low attack complexity (AC:L) by a low-privileged authenticated user (PR:L) without requiring user interaction (UI:N). The scope is unchanged (S:U), meaning the impact is limited to the Backup Server itself, but with complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). The underlying issue likely involves unsafe deserialization, template injection, dynamic code execution, or command injection within backup processing pipelines that fail to properly sanitize user-controlled inputs from authenticated domain accounts.

RemediationAI

Immediate actions: (1) Locate vendor security advisory for CVE-2025-23121 (typically published by affected vendor within 24-48 hours of CVE announcement). (2) Identify patched versions from vendor advisory and deploy to all Backup Server instances. (3) If patch is unavailable or delayed, implement network segmentation to restrict Backup Server access to trusted administrative networks only; disable domain user access to backup interfaces if operationally feasible. (4) Monitor Backup Server logs for authentication from non-administrative domain accounts or unusual backup job submissions. (5) Enable MFA for all Backup Server administrative accounts to reduce risk of authenticated exploitation. (6) Review recent access logs for suspicious activity by domain users. Patch application should be prioritized with same urgency as critical Windows security updates due to high CVSS and low barrier to exploitation.