CVE-2025-64393: Veeam Backup & Replication RCE Vulnerability

CVE-2025-64393 Overview

CVE-2025-64393 is a critical deserialization vulnerability in Veeam Backup & Replication that allows an authenticated user with the Backup Viewer role to execute arbitrary code as SYSTEM on the backup server. The flaw is tracked under CWE-502: Deserialization of Untrusted Data and carries network attack vector characteristics with low privileges required and no user interaction.

Critical Impact
A low-privileged Backup Viewer account can obtain full SYSTEM-level control of the Veeam backup server, exposing backup repositories, credentials, and recovery data to compromise.

Affected Products

Veeam Backup & Replication (refer to the Veeam Knowledge Base Article KB4934 for affected build numbers)
Deployments where the Backup Viewer role is assigned to users or service accounts
Backup infrastructure servers exposed to internal network reachability

Discovery Timeline

2026-10-07 - CVE-2025-64393 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2025-64393

Vulnerability Analysis

The vulnerability resides in the processing path available to users holding the Backup Viewer role in Veeam Backup & Replication. The Backup Viewer role is intended to provide read-only visibility into backup jobs, sessions, and reports. However, an exposed deserialization sink accepts attacker-controlled serialized data from this role and reconstructs objects without adequate type validation.

When the serialized payload is deserialized, gadget chains within the loaded assemblies can be triggered to execute arbitrary code in the context of the Veeam service, which runs as SYSTEM. This elevates a low-privileged auditing role to full control of the backup server operating system.

Because backup servers hold credentials for hypervisors, storage arrays, cloud tenants, and domain accounts, SYSTEM-level access on this host often provides a direct path to broader enterprise compromise and to ransomware-relevant data stores.

Root Cause

The root cause is unsafe deserialization of untrusted data [CWE-502]. The affected code path does not restrict permitted types or validate payload integrity before invoking the deserializer, enabling a reachable gadget chain to run during object reconstruction.

Attack Vector

An attacker must first obtain Backup Viewer credentials, which may be acquired through phishing, credential reuse, prior intrusion, or insider access. The attacker then submits a crafted serialized payload to the vulnerable interface over the network. Successful exploitation yields code execution as SYSTEM on the backup server without any user interaction. Refer to the Veeam Knowledge Base Article KB4934 for product-specific technical details.

Detection Methods for CVE-2025-64393

Indicators of Compromise

Unexpected child processes spawned by the Veeam Backup Service (Veeam.Backup.Service.exe) such as cmd.exe, powershell.exe, or rundll32.exe.
New or modified scheduled tasks, services, or local accounts created on the backup server shortly after Backup Viewer authentication events.
Outbound network connections from the Veeam backup server to untrusted destinations following Backup Viewer sessions.
Anomalous use of Backup Viewer accounts outside normal business hours or from unusual source hosts.

Detection Strategies

Monitor process lineage for the Veeam backup service process and alert on any interactive or scripting-engine child processes.
Correlate Backup Viewer role authentication events with subsequent file creation, service installation, or registry modification on the backup host.
Hunt for .NET deserialization gadget behavior, including loading of serialization-related assemblies followed by process execution APIs.

Monitoring Recommendations

Enable PowerShell script block logging and Windows command-line auditing on all Veeam backup servers.
Forward Veeam application logs, Windows Security logs, and Sysmon telemetry to a centralized SIEM or data lake for correlation.
Baseline normal Backup Viewer activity and alert on deviations such as unusual API calls or session durations.

How to Mitigate CVE-2025-64393

Immediate Actions Required

Apply the fixed Veeam Backup & Replication build as documented in the Veeam Knowledge Base Article KB4934.
Audit all accounts assigned the Backup Viewer role and remove those that are not strictly required.
Rotate credentials stored on the backup server, including hypervisor, storage, and domain service accounts, assuming prior compromise cannot be ruled out.
Restrict network access to the Veeam backup server management interfaces to administrative subnets only.

Patch Information

Veeam has published remediation guidance and fixed builds. Administrators must consult the Veeam Knowledge Base Article KB4934 to identify the exact patched version applicable to their deployment and upgrade accordingly. No supported workaround substitutes for installing the vendor patch.

Workarounds

Temporarily revoke the Backup Viewer role from all non-essential accounts until patching is complete.
Place the backup server behind network segmentation and enforce administrative jump host access only.
Enable multi-factor authentication on all accounts that interact with the Veeam backup infrastructure.
Monitor the backup server with endpoint protection configured to block unauthorized child processes from the Veeam service.

bash

# Example PowerShell audit: list Veeam users and roles for review
Add-PSSnapin VeeamPSSnapIn
Get-VBRUserRoleAssignment | Select-Object Name, Role, Type | Format-Table -AutoSize