Veeam CVE-2025-64393: a Backup Viewer can run code on the backup server, in version 12 only

A role Veeam documents as read-only is enough to run code on the backup server, in version 12 only

Veeam's advisory KB4934, published on Tuesday 6 October 2026, says that "a low-privileged user with the Backup Viewer role" can perform remote code execution on the Veeam Backup Server (CVE-2025-64393). Veeam scores it Critical, 9.4 on CVSS 4.0. Veeam's own user guide for version 12 describes the same role as having "the read-only access to the Veeam Backup & Replication console", able to view "a list of existing jobs" and "the job session details". On Veeam's own wording, the role it documents as the read-only one is enough to run code on the server that holds the backups. Only version 12 is affected, up to build 12.3.2.4854. Version 13 is not, and the fix is build 12.3.2.4934.

That is a statement about a role, not about the internet. The CVSS vector Veeam published says the attack travels over a network and needs Low privileges and no user interaction. It does not say the server must face the internet, and nothing on Veeam's page says a stranger with no account can reach it. So the first two controls are who holds Backup Viewer, and what can reach the backup server's management services. The third is the build number.

What the record does not establish matters as much. It does not say anyone is exploiting the flaw: Veeam's pages are silent on exploitation, CISA's Known Exploited Vulnerabilities catalogue (version 2026.10.08) does not list it, and CISA's own entry in the CVE record scores exploitation as none (a statement dated 7 October). It does not say how an account comes to hold the role, whether the server must be domain-joined, whether any workaround exists (the page lists none), or what a Backup Viewer must be able to reach. And "as SYSTEM", the phrase in this briefing's slug, is the wording of the CVE record, written through HackerOne as the CVE Numbering Authority. Veeam's advisory says remote code execution on the Veeam Backup Server and does not name the account.

There are four issues, not one. Veeam's release page for the 12.3 line (KB4696) lists four as fixed in 12.3.2 P4 (build 12.3.2.4934): the Backup Viewer flaw; a second Backup Viewer flaw that reaches the Enterprise Manager master key and stored antivirus update credentials (CVE-2026-93026); a reflected cross-site scripting flaw in Enterprise Manager (CVE-2025-64392); and CVE-2026-58069, which lets an authenticated Cloud Connect tenant read arbitrary files on the service provider host. The P4 advisory, KB4934, lists only the first three. The fourth is documented in a different advisory, KB4902, and its fix reached version 13 earlier: build 13.1.0.411 is dated 29 July and 13.0.3.63 is dated 25 August, 69 and 42 days before version 12 received it on 6 October (derived).

This briefing reads Veeam's own pages, the CVE.org and NVD records, CISA's catalogue file and the UK sources cited below, from 20:23 BST on Monday 12 October 2026, and re-read the catalogue, the records and Veeam's advisory pages at 20:50 BST. Press coverage was read for context only and is marked secondary. Veeam sells the product and is the only source for what the flaws are. Every CVSS score is Veeam's, entered in the CVE record by the CNA. NVD had assigned no score of its own: all four records read "Awaiting Analysis". Times are BST.

The four issues in Veeam's words, and what Veeam does not say

The first table quotes or closely paraphrases Veeam's wording from KB4934 (the P4 advisory), KB4902 (the version 13.1 advisory, which holds CVE-2026-58069) and KB4696 (the 12.3 release information). The last column is the fixed build Veeam gives.

The four issues fixed in Veeam Backup & Replication 12.3.2.4934, from Veeam KB4934, KB4902 and KB4696, read from 20:23 BST on 12 October 2026. Scores are CVSS 4.0, set by Veeam.

Issue	What Veeam says	Score, and who attacks	Fixed in
CVE-2025-64393	A low-privileged user with the Backup Viewer role can perform remote code execution (RCE) on the Veeam Backup Server, through insecure deserialization of untrusted data received via the Mount Service.	Critical, 9.4. The Backup Viewer role.	12.3.2.4934. Version 13 not affected.
CVE-2026-58069	An authenticated Veeam Cloud Connect tenant can read arbitrary files on the service provider host. Deployment type: Windows-based Veeam Backup & Replication.	High, 8.3. A Cloud Connect tenant's login.	12.3.2.4934, 13.0.3.63 and 13.1.0.411.
CVE-2026-93026	An authenticated user with the Backup Viewer role can modify or delete the Enterprise Manager master key and read or overwrite stored antivirus update credentials on the Veeam Backup Server.	Medium, 6.1. The Backup Viewer role.	12.3.2.4934. Version 13 not affected.
CVE-2025-64392	A reflected cross-site scripting flaw in Veeam Backup Enterprise Manager: script runs in the browser of an authenticated portal user who opens a crafted link.	Medium, 4.8. The victim is logged in and must click.	12.3.2.4934. Version 13 not affected.

Three of the four describe an attacker who is already authenticated, in Veeam's words: a user with the Backup Viewer role (two issues) and an authenticated Cloud Connect tenant. The fourth needs an authenticated portal user to open a crafted link. Read from the published vectors instead of the prose, all four carry Attack Vector Network and Privileges Required Low (4 of 4, derived), and the three that need no click carry User Interaction None (3 of 4, derived). Network describes how the vulnerable component is reached. It is not a statement that the server is exposed to the internet. The CVE.org records add the weakness types: deserialization of untrusted data for CVE-2025-64393, path traversal for CVE-2026-58069, missing authorisation for CVE-2026-93026 and cross-site scripting for CVE-2025-64392.

The second table sets what Veeam states against what it leaves open. The right-hand column is the list of questions a defender would ask next. None of them is answered on Veeam's pages, the CVE records or CISA's pages at the time of the read.

Stated and not stated: Veeam's KB4934 and KB4902, the CVE.org and NVD records, and CISA's entries, read from 20:23 BST on 12 October 2026.

Question	Stated	Not stated
Who can trigger the main flaw	A low-privileged user with the Backup Viewer role. Vector: network, low privileges, no user interaction.	How an account comes to hold the role. Whether it must be a domain account or the server domain-joined (Veeam said so for flaws in 2025, and KB4934 does not for this one). Which network position is needed.
What the flaw gives	Code execution on the Veeam Backup Server. The CVE record adds: as SYSTEM. The vector rates the impact High on the vulnerable system and on connected systems.	Which account the code runs as, in Veeam's own words. Which stored credentials, repositories or hypervisor links an attacker could then reach.
Versions and deployments	12.3.2.4854 and all earlier version 12 builds. Version 13 is not affected by three of the four. CVE-2026-58069: Windows-based Veeam Backup & Replication, 13.0.2.29 and earlier, 12.3.2.4854 and earlier.	Whether versions before 12 are affected. KB4934 is silent. For CVE-2026-58069, KB4902 says unsupported versions "were not tested, but are likely affected". Whether Enterprise Manager must be installed for two of the issues.
The Cloud Connect flaw	A tenant with a login can read arbitrary files on the provider host.	Which files. Whether other tenants' data or the provider's own credentials are within reach. Whether the host must have Cloud Connect switched on. How a provider would see it in logs.
Workarounds and detection	None listed. The solution is the fixed build.	Any mitigation short of patching. Any log entry or indicator. Any check to run after patching, except one note for version 13 credentials (see the checklist).
Exploitation	Nothing on Veeam's pages. CISA's entry in the CVE record says exploitation: none, dated 7 October. Not in CISA's catalogue.	Whether anyone has tried it. Whether exploit code exists. How many servers are exposed to it.

Which build fixes what, version line by line

Veeam's pages give one fixed build per line. The matrix below is drawn from KB4934, KB4902, KB4738 (the version 13 release information), KB4696, the build-number table KB2680 and Veeam's lifecycle page. Build numbers are exact: Veeam's guidance is to read the installed build in the console under Help, About.

Fixed build by version line, from Veeam's KB4934, KB4902, KB4738, KB4696, KB2680, its download page and its lifecycle page, read 12 October 2026.

Version line, and the builds Veeam lists	Which of the four apply	Fixed build, and its date on Veeam's pages
Version 12, builds up to 12.3.2.4854 (12.3.2 P3)	All four.	12.3.2 P4, 12.3.2.4934. 6 October on three Veeam pages. 29 September in the build table (KB2680).
Version 13.0, builds up to 13.0.2.29	CVE-2026-58069 only. For the other three, Veeam says version 13 is not affected.	13.0.3.63. 25 August.
Version 13.1	None. The first 13.1 build on KB4738, 13.1.0.411, carries the fix.	13.1.0.411. 29 July. 13.1.1.18 is later: 12 or 13 August, on two pages.
Version 11 and earlier	Not stated in KB4934. For CVE-2026-58069, KB4902 says unsupported versions are likely affected.	No fix named. Version 11 ended support in February 2024 on Veeam's lifecycle page.

Veeam's own pages disagree on one date. KB4696, KB4934 and Veeam's download page give 6 October 2026 for build 12.3.2.4934. The build-number table, KB2680, lists the same build as 29 September 2026, seven days earlier (derived). Nothing on the pages says which date is the day the build reached customers. This briefing uses 6 October, as three pages do, and shows below what the other date would change for the Cyber Essentials clock.

A server that applied the previous version 12 build is still in range. Build 12.3.2.4854, Veeam's fix for the critical CVE-2026-44963, is dated 8 June in KB4696 and 9 June in KB2680, and KB4934 lists it as affected. The gap from 8 June to 6 October is 120 days (derived). The CVE record for CVE-2026-58069 adds a trap: it lists version 13 as affected up to and including 13.0.3 and version 12 up to and including 12.3.2. Read literally, those ranges include the fixed builds. Match on the build numbers in Veeam's KB4902, not on the record's range.

The figure makes one point a table cannot. The Cloud Connect flaw was fixed in version 13 on 29 July and again on the 13.0 line on 25 August, and the CVE records were published on 7 October, 70 and 43 days after those builds (derived). This briefing cannot tell from Veeam's pages when the CVE-2026-58069 lines were added to KB4738 and KB3103, whose last-modified dates are 5 October, so this briefing does not claim the flaw was publicly described in July. It says only that the builds that fix it are dated then. For a Cloud Connect provider on version 13, the practical reading is that the fix has been available for 75 days for the 13.1 line and 48 days for the 13.0 line (derived).

Is it exploited? What CISA, Veeam and others said between 20:23 and 20:50 BST

Exploitation status of the four issues as read on 12 October 2026. The third column says what each source does not say.

Source	What it says	What it does not say
CISA catalogue file, version 2026.10.08, released 8 October	None of the four is listed. The file has 1,739 entries, four of them Veeam (CVE-2024-40711, CVE-2023-27532, CVE-2022-26500 and CVE-2022-26501).	Anything after 8 October. The next release may differ.
CISA's SSVC entry in each CVE record, dated 7 October	Exploitation: none. Automatable: no. Technical impact: total for CVE-2025-64393, partial for the other three.	That nothing has happened since 7 October. It is an assessment at a time.
Veeam KB4934, KB4902, KB4696, KB3103	No statement on exploitation. Veeam says attackers "will likely attempt to reverse-engineer the patch" once a fix is public.	Whether Veeam knows of any attempt.
Cyber Security Agency of Singapore alert AL-2026-138, 9 October	Repeats the CVE record and says patch immediately.	Any attack. It describes what an attacker with the role can do.
The Hacker News weekly recap, 12 October (secondary)	Lists CVE-2025-64393 and CVE-2026-58069 among its trending CVEs, with no description.	Why they are listed. Its heading says the list includes bugs that are severe, widely used or being exploited.
A Japanese security news site, 8 October (secondary)	Says none of the four was confirmed in CISA's catalogue, no reliable public exploit code was found, and Veeam's KB does not describe exploitation.	A statement by Veeam. Its summary line says Veeam reports no exploitation, its body says only that the KB does not describe any, and the KB contains no statement either way.
Threat-intelligence vendors	Searches for the identifier on the sites of Rapid7, Huntress, watchTowr, GreyNoise and others found no report.	That none exists. A search is not a census.

So at the time of the read: not in the catalogue, not described as exploited by Veeam, scored none by CISA's enrichment, and no vendor report found. Each is an absence. The NCSC's guidance says the catalogue reports exploitation that has already occurred, so absence from it is not evidence of safety. This briefing found no public exploit code by search and links none. The NCSC warns that released exploit code has a long history of attacking the person who runs it.

The precedent is on the same product and is not reassuring. CISA lists four Veeam Backup & Replication flaws, the latest added on 17 October 2024, 725 days before this read (derived). All four carry CISA's flag for known ransomware campaign use: 4 of 4 for Veeam, against 361 of 1,739 (20.8 per cent) across the whole catalogue (derived). Four entries is a small sample, and the flag is CISA's, not a count of incidents. One difference matters for triage: CISA describes all four as unauthenticated flaws. None of the October four is described that way. They need a role, a tenant login, or a victim who is logged in.

A second pattern is visible on Veeam's own 12.3 page. It lists 17 CVE entries across the 12.3 line since December 2024 (derived by counting). Three of them name the Backup Viewer role: CVE-2026-21708 of 12 March 2026, which Veeam says lets a Backup Viewer perform remote code execution as the postgres user, and the two of 6 October. The component Veeam calls the Mount Service also appears in an October 2025 entry, CVE-2025-48983. Ten of the 17 entries are in three security builds dated 12 March, 8 June and 6 October 2026, 208 days from the first to the last (derived). In 13 of the 17 entries Veeam's own description names an attacker who is already authenticated: a domain user, a role or a tenant (derived by reading the descriptions). The other four are a link click by a logged-in user and three local privilege escalations. That does not show the next flaw is coming. It is this briefing's reading that the findings in this product have mostly been about what an authenticated account can do, not about what a stranger can reach.

Why a backup server matters to ransomware defenders, and where the evidence is a statement and not a count

Four sources say it, and none of them gives a count of incidents. CISA's #StopRansomware advisory on Akira (AA24-109A, last revised 13 November 2025) says Akira actors "exploit publicly available vulnerabilities, such as those found in the Veeam Backup and Replication component of unpatched Veeam backup servers", and names CVE-2023-27532 and CVE-2024-40711. The NCSC's ransomware guidance (published 2020, reviewed 9 September 2021) says ransomware actively targets backups to increase the likelihood of payment, and asks for backup products to be patched regularly. The NCSC's 2019 blog says it has seen numerous incidents where ransomware encrypted the connected storage holding backups. Veeam's own ransomware page, updated 11 August 2026, says "Backups and identity are targets" and that many campaigns target "backup infrastructure, privileged credentials, identity systems, hypervisors, and management consoles". Veeam sells backup software, which is its interest in saying so.

These are general statements. No source read for this briefing says how many ransomware incidents involved a Veeam server, or how many Veeam servers are unpatched or exposed. The catalogue flag in the previous section is the only count, and it counts four vulnerabilities. The reason the statements are credible without a count is structural, and the inference is this briefing's: a backup server holds the means to restore, and it holds credentials to the systems it protects. Veeam's own best practice guide, written by its solutions architects, says an attacker with high privilege on backup servers "can get credentials of user accounts and compromise other systems". CVE-2026-93026 in this very release is about a master key and stored credentials on the backup side. An earlier briefing covers a different backup product, AhsayCBS, where the vendor and a security firm disagreed about which version is fixed, and another covers the gap between a patch and the use of a flaw by ransomware groups, Palo Alto's CVE-2026-0257 at 149 days.

Seven labels that sound like controls

A label can pass for a control when the question is asked quickly. Each of the seven below is true of something. None of them, on Veeam's pages, stops a flaw on a server that has not been updated.

Seven labels, and what Veeam's pages and the other sources read say about each. Entries marked inference are this briefing's reading, not a source's statement.

Label	What it sounds like	What the record says
Backup	A safety net outside the attack.	The NCSC says ransomware actively targets backups. The backup server holds keys and credentials: CVE-2026-93026 names an Enterprise Manager master key and stored antivirus update credentials.
Viewer	Read-only, so harmless.	Veeam's guide: read-only console access, with job lists and session details. Veeam's advisory: that role is enough for code execution on the server. The label describes the console, not the service behind it (inference).
Authenticated	A known person is logged in.	For the Cloud Connect flaw the login is any tenant's, so any customer of the provider. For the Backup Viewer flaws it is a role that an administrator granted to a user or a group. Authentication says who, not how much.
Immutable	Nothing can change it.	Veeam writes that a properly configured immutable backup "is designed to prevent alteration or deletion within its retention window". It protects the stored copy for that window. It does not patch the server that writes it, and a backup server is where credentials sit (inference).
Air-gapped	Out of reach.	The NCSC's term is offline: connect a backup to live systems only when necessary, and never have all copies connected at once. A copy that is offline when the attack comes is out of reach. The connected server, its credentials and a copy that is connected are not (inference).
Not in the catalogue	Not exploited.	The catalogue lists exploitation after it has happened (NCSC). The four older Veeam entries were listed and flagged for ransomware use. Absence today is a time-stamped fact, not a control.
Version 13 is not affected	Move to 13 and forget it.	True for three of the four. CVE-2026-58069 affects 13.0.2.29 and earlier version 13 builds, and the same builds fix a different issue, CVE-2026-58070, where guest credentials for application-aware processing were written to logs.

The step from code execution on the backup server to what an attacker could reach is an inference. Veeam's advisory does not list the reachable credentials, repositories or hypervisor links. The vector's "High" on connected systems is the one hint, and it is a rating, not a description.

The UK: the 14 days, the NCSC's clocks, the provider contract and the 72 hours

Cyber Essentials v3.3 (April 2026) requires software on in-scope devices to be licensed and supported, and to be updated within 14 days of release where the update fixes flaws that the vendor describes as critical or high risk, or that score 7 or more on CVSS v3. It adds that if an update covers several issues and any one is critical or high risk, the update must be installed within 14 days. Veeam calls CVE-2025-64393 Critical, so the P4 build meets the vendor-wording test even though Veeam's scores are CVSS 4.0 (this briefing's reading of the clause). From 6 October the 14 days end on Tuesday 20 October 2026, 8 days from the read (derived). If the 29 September date in Veeam's build table were the release date, they would end on Tuesday 13 October, tomorrow (derived). For CVE-2026-58069, Veeam rates the flaw High, and a version 13 server still on 13.0.2.29 is 34 days past the 14 days that ran from the 25 August build (derived).

UK clocks as read on 12 October 2026, from 20:23 BST. The last column applies each to the 6 October build, with arithmetic labelled derived.

Source, as read	What it says	Date for this build (derived)
Cyber Essentials v3.3, Security Update Management (April 2026)	Update within 14 days of release if the vendor says critical or high risk, or CVSS v3 is 7 or more. A whole update counts if any one issue does. Software must be supported, and the vendor must give the date support ends.	Tuesday 20 October 2026. Tuesday 13 October if 29 September is the release date. Veeam gives 28 February 2027 for version 12.
NCSC vulnerability management, best-practice timescales (version 2.1, reviewed 1 May 2026)	Internet-facing services 5 days. Operating systems and applications 7 days. Internal or air-gapped services 14 days. They apply to all updates, regardless of severity.	Sunday 11 October, Tuesday 13 October and Tuesday 20 October. A Cloud Connect host that tenants reach across the internet is in the 5 day class (inference).
NCSC compressed timescales for exploited flaws	Under 24, 48 or 72 hours with an incident response provider, when the flaw is in the CISA catalogue and exploited, depending on exposure, automation and control.	Not triggered at the read. They would apply from the day CISA lists a Veeam flaw.
ICO guide to personal data breaches (UK GDPR Article 33)	Report a notifiable breach within 72 hours of becoming aware. A breach covers confidentiality, integrity or availability. A processor must tell the controller without undue delay.	Runs from awareness of a breach, not from the patch.
Cyber Security and Resilience (Network and Information Systems) Bill	Brings medium and large managed service providers under the NIS Regulations. The government factsheet (updated 30 June 2026) lists backing up customer data among example activities. Lords report stage is listed for 26 October 2026, provisionally.	Not law at the read. 14 days from now. Whether a Cloud Connect repository-only service is a managed service under the definition is not stated.

Two further points from Cyber Essentials v3.3. Backing up is not a technical requirement of the scheme, but the document says it is highly recommended and that its importance is emphasised in this version. And cloud services cannot be left out of scope: where a provider implements a control for you, the document says you must make sure the provider has committed to it in the contract or in documents the contract references. The table of who patches what lists both the customer and the provider for infrastructure and platform services, and the provider alone for software services. Which of those a Cloud Connect repository is, the document does not say.

That is the contractual question for the many UK organisations that back up to a service provider running Cloud Connect, and for the providers themselves. CVE-2026-58069 is a flaw in the provider's host, reachable by any authenticated tenant. The customer cannot patch it. The customer can ask who does, how fast, and how it will be told. The NCSC says its timescales can help an organisation develop contracts to achieve best practice. The ICO says a controller must choose a processor with sufficient guarantees, and the written contract must require the processor to take the Article 32 measures. If a provider is a processor of backups that hold personal data (a reading of the arrangement, not something Veeam states), Article 33(2) makes it tell the customer without undue delay, and the customer's 72 hours run from when it is aware.

The ICO's point on backups is the reason the issue sits in data protection and not only in IT. Article 32 asks for the ability to restore availability and access to personal data in a timely manner after a technical incident, and the ICO's security guide lists an appropriate backup process as one way to meet it. A person who reaches a backup server could read, alter or delete backups that hold personal data. That is a possible breach of confidentiality, integrity or availability. Whether a given incident is reportable depends on the risk to people, which only the organisation can assess. The NCSC's wording for who may reach backup systems is stricter than a role: ideally, protect backup accounts and solutions with privileged access workstations and hardware firewalls that enforce IP allow listing, enable multi-factor authentication, and keep the method off the device used to administer backups. That page is from 2021, and it is the NCSC's current ransomware guidance page as read.

What to do, in the order worth doing

The order follows the NCSC's own: know what you run, update, check whether you were already reached, then close the gap that lets the next one in. This is defender level only. No request, path or code is given here, and none is needed.

What could not be verified

Status as read from 20:23 BST and re-checked at 20:50 BST on 12 October 2026. Each line says how this briefing handles the gap.

Question	Status	How this briefing handles it
Is any of the four exploited?	Not in CISA's catalogue (version 2026.10.08). Veeam's pages are silent. CISA's SSVC entry says none. No vendor report found by search.	Stated as not shown, and time-stamped.
The release date of 12.3.2.4934	6 October on KB4696, KB4934 and Veeam's download page. 29 September in KB2680. The patch file name on KB4696 carries 20260918, a build stamp that Veeam does not call a release date.	6 October used, and the 29 September effect on the 14 days shown.
When the CVE-2026-58069 lines were added to KB4738 and KB3103	Both pages show a last-modified date of 5 October. Internet Archive captures were not available.	The briefing says the builds are dated 29 July and 25 August, and does not say when the flaw was described.
Whether the flaw runs as SYSTEM	The CVE record says so. Veeam's KB4934 does not.	Attributed to the CVE record. Veeam's LocalSystem guidance noted as an inference.
How an account comes to hold Backup Viewer, and whether domain-joining matters	Veeam's guide says administrators add users or groups with a role. KB4934 states no domain condition.	Listed as not stated.
Whether Cloud Connect repository-only services are managed services under the Bill	The factsheet's definition and examples were read. The Bill text was not.	Listed as not stated. The Bill is described only as the factsheet and the stages page describe it.
The number of exposed or unpatched Veeam servers	No source read gives one.	Not estimated.
A separate Veeam "security bulletin" page for October	None was found. KB4934 is the advisory the CVE records link to, with KB4902 for CVE-2026-58069.	KB4934, KB4902, KB4696 and KB3103 read.

The question that exposes the gap

Seven labels each sound like a control, and on Veeam's pages none of them is one for a server that is not on the fixed build. The page offers one control, a build number, and one date for it is in dispute by seven days. Which accounts and groups hold the Backup Viewer role on your backup server today, who put them there, and if one of them were used to run code on that server tonight, which copy of your backups could you still restore from?

Key facts