CVE-2025-23121criticalCWE-94

CVE-2025-23121: critical vulnerability in Veeam Backup and Recovery

Published · Updated

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.9epss 24%
exploitation probability
24%top 2% of all CVEs
observed exploitation
nono source reports it
In short

A Backup Server allows an authenticated domain user to run arbitrary code remotely. This is critical because attackers with valid domain credentials can fully compromise the backup system and access all backed-up data.

Technical detail

CWE-94 (Code Injection) vulnerability in Backup Server permits remote code execution when an authenticated domain user submits specially crafted input. Exploitation requires valid domain credentials and network access; successful exploitation grants arbitrary code execution with server privileges, enabling data exfiltration and system compromise.

Summary generated and translated by AI from the official description.
A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Veeam · Backup and Recovery
Related CVEs — Veeam Backup and Recovery

In the same product, most dangerous first.

CVE-2025-23120CRITICALCVE-2025-23120EPSS 24.0%CVE-2025-24286HIGHCVE-2025-24286EPSS 19.1%CVE-2025-59470CRITICALCVE-2025-59470EPSS 1.5%CVE-2024-40710HIGHCVE-2024-40710EPSS 1.1%CVE-2025-59468CRITICALCVE-2025-59468EPSS 1.0%CVE-2024-39718HIGHCVE-2024-39718EPSS 0.8%
References
https://www.veeam.com/kb4743