EUVD-2025-211039
GHSA-6m95-66x2-x5hx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity deserialization needs only the low-privilege Backup Viewer role (PR:L); code runs as SYSTEM, crossing from the app to the OS authority (S:C) with full C/I/A loss.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
3DescriptionCVE.org
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
AnalysisAI
Authenticated users holding only the low-privileged 'Backup Viewer' role on Veeam Backup & Replication can leverage a deserialization flaw to execute arbitrary code as SYSTEM on the backup server, turning a read-only backup monitoring account into full control of the backup infrastructure (CVSS 9.4; CWE-502). The attack is network-reachable (AV:N) and requires no user interaction, but it is not unauthenticated: a valid Backup Viewer account or stolen credentials for that role are mandatory (PR:L), which realistically limits exposure to insiders, credential-theft scenarios, or attackers who have already chained into the environment. The high severity is compounded by the scope change (S:C) and full loss of confidentiality, integrity, and availability across the backup server and connected systems; no public exploit code or confirmed active exploitation was identified at time of analysis.
Technical ContextAI
The root cause is CWE-502, Deserialization of Untrusted Data. In this class of bug, the application reconstructs an object graph from attacker-influenced serialized input without adequate type or integrity validation, allowing the attacker to instantiate types whose side effects during construction or finalization lead to arbitrary code execution in the hosting process. Because the affected component is the Veeam Backup & Replication backup server itself, successful exploitation runs with the privileges of that service - SYSTEM - and the CVSS 4.0 vector records a scope change (SC:H/SI:H/SA:H), meaning impact is not confined to the vulnerable component but extends to other components and the wider backup estate it manages. Both the vendor-assigned CVSS 4.0 score (9.4) and the independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) agree on the key prerequisites: the flaw is remotely reachable, requires low-privileged authentication but no user interaction, and needs no special non-default configuration beyond network reachability of the backup server. The CPE record cpe:2.3:a:veeam:backup_and_replication:*:*:*:*:*:*:*:* identifies Veeam Backup & Replication as the product family, with affected version ranges enumerated by the vendor rather than in the CPE string.
RemediationAI
Veeam has published a vendor knowledge base article for this issue at https://www.veeam.com/KB4934; because the available data does not include an explicit patched build number, administrators should treat that KB as the authoritative source, consult it for the exact fixed release, and upgrade all Veeam Backup & Replication servers to the version it specifies (patch availability per vendor advisory - released patched version not independently confirmed here). Until the upgrade is applied, treat every account holding the Backup Viewer role as a potential SYSTEM-level code execution path: restrict Backup Viewer assignments to the minimum needed personnel, and remove the role from service accounts, integration accounts, and any identity that is not actively reviewing backups, since the role is the sole authentication prerequisite and cannot be further reduced by configuration. Harden the surrounding access path instead of relying on role settings alone - place the backup server's management and agent interfaces behind segmentation, restrict who can reach those ports over the network, and enforce MFA and strong credential hygiene on all Veeam logon accounts (the PR:L prerequisite means credential theft is the most likely real-world vector, so credential compromise directly converts into code execution). Log and alert on anomalous backup server process behavior and on additions to privileged or Backup Viewer group memberships, and review audit trails for existing evidence of deserialization abuse, as successful exploitation leaves the attacker with full control of backups and the ability to tamper with or destroy recovery data. Note the trade-off that tightening Backup Viewer membership may slow routine restore-verification and monitoring workflows, so plan a formal role review rather than ad hoc revocation.
More in Backup And Replication
View allLocal privilege escalation in Veeam Agent for Microsoft Windows enables a low-privileged authenticated user to escalate
Remote code execution in Veeam Backup & Replication enables an authenticated domain user to execute arbitrary code on th
Arbitrary file write in Veeam Backup & Replication 13 (≤13.0.1) on Linux-based deployments allows an authenticated Backu
Local privilege escalation in the Veeam Updater component of the Veeam Software Appliance allows a high-privileged local
Authenticated Cloud Connect tenants can read arbitrary files on the Veeam Backup & Replication service provider host thr
Credential exposure in Veeam Backup & Replication occurs when guest OS processing operations write privileged account cr
Bypass of Windows Driver Signature Enforcement in Veeam Backup and Replication 12.x and Software Appliance 13.x allows l
Authenticated Backup Viewer accounts in Veeam Backup & Replication can modify the Enterprise Manager master key and stor
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today