CVE-2025-23121

A Backup Server allows an authenticated domain user to run arbitrary code remotely. This is critical because attackers with valid domain credentials can fully compromise the backup system and access all backed-up data.

CWE-94 (Code Injection) vulnerability in Backup Server permits remote code execution when an authenticated domain user submits specially crafted input. Exploitation requires valid domain credentials and network access; successful exploitation grants arbitrary code execution with server privileges, enabling data exfiltration and system compromise.