What is the CVSS score of CVE-2025-48984?

CVE-2025-48984 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Veeam Backup & Replication are affected by CVE-2025-48984?

Veeam Backup & Replication contains a high-severity remote code execution vulnerability (CVE-2025-48984) that requires valid domain credentials and network access to the backup server.

How to fix or mitigate CVE-2025-48984?

Within 24 hours, restrict network access to Veeam Backup & Replication servers to only essential administrative personnel and monitor for unusual activity. Within 7 days, conduct a review of domain accounts with access to backup infrastructure, enforce least privilege, and ensure multi-factor authentication is enabled for all administrative access. Within 30 days, implement network segmentation to isolate backup servers from general user networks and prepare for patch deployment once available by subscribing to Veeam security advisories and testing patches in a staging environment before production rollout.

Veeam Backup & Replication CVE-2025-48984

HIGH

Code Injection (CWE-94)

2025-10-31 support@hackerone.com

RCE Code Injection Veeam Backup Replication

8.8

CVSS 3.1 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable code injection needing any domain account gives AV:N/AC:L/PR:L/UI:N; RCE on the backup server yields full C:H/I:H/A:H with scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 21:41 vuln.today

CVE Published

Oct 31, 2025 - 00:15 cve.org

HIGH 8.8

DescriptionCVE.org

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

AnalysisAI

Remote code execution in Veeam Backup & Replication allows an authenticated domain user with network access to the backup server to execute arbitrary code. The flaw requires valid domain credentials but no user interaction and has low attack complexity, making it a significant risk for domain-joined deployments. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

Veeam Backup & Replication is an enterprise backup and replication solution. The vulnerability is classified as CWE-94 (Code Injection), indicating that the application fails to properly neutralize special elements that could alter the control flow or execution of code, leading to remote code execution. The affected product is identified by CPE cpe:2.3:a:veeam:veeam_backup_&_replication:*:*:*:*:*:*:*:*, which suggests that all versions may be vulnerable until patched. The specific injection point and affected component are detailed in the vendor advisory (KB4771). Exploitation requires the attacker to be an authenticated domain user and to have network reachability to the backup server, as confirmed by the CVSS vector (PR:L) and the independent assessment.

RemediationAI

Apply the vendor-released patch as detailed in Veeam advisory KB4771 (https://www.veeam.com/kb4771). Patch availability is confirmed per the vendor advisory, though the exact fixed version is not specified in the available data. Until patching is possible, restrict network access to the Veeam Backup & Replication server to only trusted hosts and ensure that domain user credentials are strictly managed, as any authenticated domain user can exploit the vulnerability. No specific workarounds are mentioned in the available data, so patching remains the primary mitigation.