Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2.4165 Patch

CVE-2025-48983

A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.

Severity: Critical
CVSS v3.1 Score: 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: Reported by CODE WHITE.

CVE-2025-48984

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

Severity: Critical
CVSS v3.1 Score: 9.9>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: Reported by Sina Kheirkhah (@SinSinology) and Piotr Bazydlo (@chudyPB) of watchTowr.

CVE-2025-48982

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file.

Severity: High
CVSS v3.1 Score: 7.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Source: Reported by an anonymous contributor working with the Trend Zero Day Initiative.

Affected Product

Veeam Agent for Microsoft Windows 6.3.2.1205 and all earlier version 6 builds.
_{Note: Unsupported product versions are not tested, but are likely affected and should be considered vulnerable.}

Solution

This vulnerability was fixed starting in the following build:

• Veeam Agent for Microsoft Windows 6.3.2.1302
  ^{Veeam Agent for Microsoft Windows is included with Veeam Backup & Replication and available as a standalone application.}