- Veeam finds security bug plaguing a number of its products
- The bug allows threat actors to run arbitrary commands
- Patches are already available, so users are instructed to update now
Multiple Veeam Backup products were found carrying a critical severity vulnerability that allowed malicious actors to run arbitrary commands on compromised endpoints.
The company said the vulnerability was discovered in the Veeam Updater component, allowing threat actors to run man-in-the-middle (MitM) attacks, executing arbitrary codes with root-level permissions. It is now tracked as CVE-2025-23114, and comes with a severity score of 9.0/10 (critical).
Multiple products are vulnerable, including Veeam Backup for Salesforce (3.1 and older), for Nutanix AHV (5.0 and 5.1), for AWS (6a and 7), for Microsoft Azure (5a and 6), for Google Cloud (4 and 5), and Veeam Backup for Oracle Linux Virtualization manager and Red Hat Virtualization (3, 4.0, and 4.1).
Patches and risks
The patches are already available, so users are advised to update their products to the newest version to mitigate potential risks. A full list of patches can be found on this link.
Veeam also stressed that not everyone is vulnerable: “If a Veeam Backup & Replication deployment is not protecting AWS, Google Cloud, Microsoft Azure, Nutanix AHV, or Oracle Linux VM/Red Hat Virtualization, such a deployment is not impacted by the vulnerability,” it said.
Veeam’s solutions are popular among SMBs and enterprises, and as such are often targeted. In mid-October last year, researchers warned of cybercriminals abusing a vulnerability in Veeam Backup & Replication, tracked as CVE-2024-40711. This bug allowed them to create a local account which they subsequently used to deploy two ransomware variants: Fog and Akira.
The researchers observed a handful of attack attempts. Admins were advised to upgrade to the latest version to mitigate the risk of exploitation.
Via The Hacker News
