A low-privilege account can run code on a vulnerable Veeam backup server through a flaw the company has now patched. Veeam published its advisory on October 6, and Singapore’s Cyber Security Agency issued an alert on October 9.
The flaw crosses a permission boundary inside backup infrastructure. An account assigned the Backup Viewer role can gain capabilities far beyond viewing information. Singapore’s agency says successful exploitation could run code as SYSTEM, a highly privileged Windows account.
Tracked as CVE-2025-64393, the vulnerability carries a severity score of 9.4 out of 10. That score describes the technical risk; it does not measure how many installations have been attacked.
Veeam attributes the flaw to insecure deserialization, the process of turning received data back into objects the software uses. Its Mount Service accepts untrusted data in a way that can lead to code execution on the backup server.
The affected releases include version 12 builds through 12.3.2.4854. Veeam identifies 12.3.2 P4, build 12.3.2.4934, as the fixed release and says version 13 builds are unaffected.
The same update addresses two additional issues. One lets an authenticated Backup Viewer modify sensitive keys or stored credentials. Another can run a script in an authenticated Enterprise Manager user’s browser after that user opens a crafted link.
Neither advisory reports active exploitation of the critical flaw. Singapore’s agency nevertheless recommends immediate updating. Veeam also lists February 28, 2027, as the end of support for version 12.
The current fix is available for version 12.
