What is the CVSS score of CVE-2025-48983?

CVE-2025-48983 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Veeam Backup & Replication are affected by CVE-2025-48983?

A critical remote code execution flaw in the Veeam Backup & Replication Mount service puts the organization's backup infrastructure - the last line of defense against ransomware - at risk of being…

How to fix or mitigate CVE-2025-48983?

Within 24 hours, confirm which Veeam Backup & Replication servers are domain-joined and whether the Mount service is reachable from general user subnets, then immediately restrict network access to that service so only explicitly trusted management hosts can reach it - this is the single highest-value interim mitigation given no vendor patch is available. In parallel, open a support case with Veeam to obtain the vendor's current workaround guidance, and ask your security monitoring team to alert on unexpected Mount service connections and on privileged or anomalous activity originating from low-privileged domain accounts. Within 7 days, treat all domain-joined Veeam servers as high-value Tier 0 assets: enforce multi-factor authentication and just-in-time privileged access for administrative accounts, remove interactive logon rights from service and low-privilege accounts that do not require them, review and prune stale or over-permissioned domain accounts, and validate that backup copies are immutable or offline so a compromise of the primary backup server cannot cascade. Within 30 days, complete network segmentation of the backup environment into a dedicated zone with deny-by-default firewall rules, deploy endpoint detection and response coverage on all backup infrastructure hosts, verify that offline/air-gapped or immutable backup copies are tested and restorable, and establish a standing process to apply the Veeam patch as soon as the vendor releases it - re-testing the exposure after any patch or configuration change.

Veeam Backup & Replication CVE-2025-48983

CRITICAL

Improper Access Control (CWE-284)

2025-10-31 support@hackerone.com

Authentication Bypass RCE Veeam Backup Replication

9.9

CVSS 3.1 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable Mount service exploitable by any authenticated domain user (PR:L, AV:N, AC:L); RCE on the backup host yields full C/I/A with a scope change to the infrastructure.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 21:41 vuln.today

CVE Published

Oct 31, 2025 - 00:15 cve.org

CRITICAL 9.9

DescriptionCVE.org

A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.

AnalysisAI

Remote code execution in the Mount service of Veeam Backup & Replication allows any authenticated domain user to execute arbitrary code on the backup infrastructure host, rated 9.9 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The vulnerable code is a core backup component rather than an optional feature, so exposure is bounded primarily by two conditions: the Veeam server must be domain-joined and its Mount service must be reachable from attacker-controlled hosts, and the attacker must already hold a valid domain account. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit code identified at time of analysis, meaning the realistic threat model is lateral movement or privilege escalation from a low-privileged domain foothold rather than an unauthenticated internet-facing breach.

Technical ContextAI

The vulnerability is rooted in CWE-284 (Improper Access Control) within the Mount service, the component responsible for mounting backup repositories, restore points and virtual disks so that proxy or agent hosts can read image-level backups for restores, Instant Recovery and file-level recovery. Because mounting typically requires the service to broker filesystem and process operations on behalf of remote callers, an authorization check on the mount request is security-critical; the flaw allows a caller who merely holds credentials for any authenticated domain user (PR:L) to direct the service into executing code, which the CVSS scope-changed rating (S:C) reflects as impact extending beyond the vulnerable component to the underlying backup infrastructure host. The service is normally network-exposed to backup proxies and agents (AV:N) and requires no user interaction (UI:N). The supplied CPE entry cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:* uses a wildcard for the version, indicating the intelligence feed did not enumerate a specific affected version range; the precise list of affected builds must be taken from the vendor advisory (Veeam KB4771). Note that the reference tags include 'Authentication Bypass', but the authoritative assessed vector carries PR:L, so the correct reading is that the check can be bypassed or circumvented by any authenticated domain user - not that the service is reachable by an unauthenticated attacker.

RemediationAI

Apply the fixed build identified by the vendor advisory at https://www.veeam.com/kb4771 - the provided intelligence does not include an exact fix version, so the specific patched release number must be confirmed directly from that KB before upgrading, and no version should be assumed. If immediate patching is not possible, the highest-value compensating control is network containment: restrict access to the Veeam Mount service ports on backup infrastructure hosts with host-based firewall rules so that only known backup proxies, agents and administrative jump hosts can reach them, accepting the trade-off that unlisted hosts lose mount-based restores, Instant Recovery and file-level recovery until rules are updated. Segmenting or removing the backup server from the Active Directory domain reduces the blast radius, but breaks domain-based authentication, delegated restore permissions and some integrated features, so it is only realistic for standalone deployments. Reducing the population of domain accounts with network reach to the backup network is also effective, at the cost of operational flexibility for helpdesk and restore operators. Finally, enable and review logging for the Mount service and its child processes - unexpected mounts or process spawns initiated by ordinary domain users are the practical detection signal, since exploitation prerequisites mean the attacker already appears as a legitimate authenticated account.