Veeam backup software has a serious security flaw - here's how to stay safe

A person's fingers type at a keyboard, with a digital security screen with a lock on it overlaid.

(Image credit: Shutterstock / Thapana_Studio)

Veeam finds security bug plaguing a number of its products
The bug allows threat actors to run arbitrary commands
Patches are already available, so users are instructed to update now

Multiple Veeam Backup products were found carrying a critical severity vulnerability that allowed malicious actors to run arbitrary commands on compromised endpoints.

The company said the vulnerability was discovered in the Veeam Updater component, allowing threat actors to run man-in-the-middle (MitM) attacks, executing arbitrary codes with root-level permissions. It is now tracked as CVE-2025-23114, and comes with a severity score of 9.0/10 (critical).

Multiple products are vulnerable, including Veeam Backup for Salesforce (3.1 and older), for Nutanix AHV (5.0 and 5.1), for AWS (6a and 7), for Microsoft Azure (5a and 6), for Google Cloud (4 and 5), and Veeam Backup for Oracle Linux Virtualization manager and Red Hat Virtualization (3, 4.0, and 4.1).

Patches and risks

The patches are already available, so users are advised to update their products to the newest version to mitigate potential risks. A full list of patches can be found on this link.

Veeam also stressed that not everyone is vulnerable: "If a Veeam Backup & Replication deployment is not protecting AWS, Google Cloud, Microsoft Azure, Nutanix AHV, or Oracle Linux VM/Red Hat Virtualization, such a deployment is not impacted by the vulnerability," it said.

Veeam’s solutions are popular among SMBs and enterprises, and as such are often targeted. In mid-October last year, researchers warned of cybercriminals abusing a vulnerability in Veeam Backup & Replication, tracked as CVE-2024-40711. This bug allowed them to create a local account which they subsequently used to deploy two ransomware variants: Fog and Akira.

The researchers observed a handful of attack attempts. Admins were advised to upgrade to the latest version to mitigate the risk of exploitation.

Via The Hacker News

Veeam vulnerability exploited to deploy malware via compromised VPN credentials
We've rounded up the best password managers
Take a look at our guide to the best authenticator app

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.