Data Backup and Recovery
,
Data Security
‘Real Danger’ Alert for Unpatched Veeam Servers Attached to a Production Domain
Widely used Veeam Backup & Replication software received a patch fixing for a remote code execution flaw that poses a serious risk to users.
See Also: 5 Successful Strategies to Overhaul Your Data Security
Veeam said the vulnerability, tracked as CVE-2025-23120, can be exploited by “authenticated domain users” to remotely execute code. The vendor said the critical vulnerability rates 9.9 out of 10 on the Common Vulnerability Scoring System scale.
In a Wednesday security alert that detailed the flaw publicly, Veeam recommended installing a newly released version of the software – Veeam Backup & Replication 12.3.1 – to fix the flaw.
The security alert says the flaw exists in earlier 12.3 versions, as well as all previous version 12 builds. Version 11 and earlier builds of the software – none of which are still supported and haven’t been tested – may also be vulnerable.
The no proof-of-concept exploit is so far available publicly, but security experts advise immediate patching. Hackers – especially ransomware groups – have repeatedly targeted backup tools and Veeam’s popular software, oftentimes after first gaining access to a corporate network and targeting a server through an internal attack vector.
More than a fifth of incidents in 2024 that Rapid7 responded to “involved Veeam being accessed or exploited in some manner, typically once an adversary has already established a foothold in the target environment,” the cybersecurity firm said. Rapid7 recommended all Veeam users ensure their backup servers aren’t exposed to the internet, which will make them more difficult – although far from impossible – for hackers to exploit.
One wrinkle with CVE-2025-23120 is that it can be exploited only if the Veeam Backup & Replication system is joined to the same domain as an authenticated user. Veeam recommends never doing this: the company’s guidelines state that a backup server should never be part of a production domain.
“For large environments, it is recommended to add the backup server and other backup infrastructure components to a management domain in a separate Active Directory forest,” according to the guidelines. “For medium-sized and small environments, backup infrastructure components can be placed on a separate workgroup.”
How many users follow this guidance isn’t clear. “Veeam explicitly mentions that domain-joined backup servers are against security and compliance best practices, but in reality, we believe this is likely to be a relatively common configuration,” Rapid7 said.
watchTowr, which discovered the flaw, said it reported the flaw to Veeam on Feb. 5, after which the vendor acknowledged receipt on Feb. 10 and followed up on March 5 to say it had confirmed the vulnerabilities and prepped a fix, which it released Wednesday.
“If you have not patched your Veeam server and it is joined to your AD domain, you are probably in real danger,” the firm said in a Thursday blog post co-authored by Piotr Bazydlo, principal vulnerability researcher, and Sina Kheirkhah, fellow vulnerability researcher.
Expect imminent exploits. Bazydlo said in a post to social platform X that anyone with knowledge of CVE-2024-40711, a remote code execution vulnerability that Veeam patched in September 2024, could easily modify the exploit code to target CVE-2025-23120 (see: Patch Alert Issued for Veeam Backup & Replication Software).
“Unfortunately, it’s super simple,” he said.
The underlying problem involves how Veeam Backup & Replication attempts to secure deserialization.
Programming environments require the ability to convert – or serialize – data or objects stored in a language into usable objects in memory, as well as deserialize them to get them back out again. Unless deserialization capabilities get carefully protected, attackers can potentially abuse them to run malicious code.
Researchers found that “Veeam Backup & Replication exposes the .NET Remoting channel,” which could allow an attacker to access “some internal deserialization capabilities based on BinaryFormatter.”
“The BinaryFormatter type is dangerous and is not recommended for data processing,” Microsoft said in August 2024. “Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they’re processing to be trustworthy. BinaryFormatter is insecure and can’t be made secure.”
To protect its software against deserialization attacks, “Veeam introduced a custom formatter, which protects against an unsafe deserialization through a whitelist-type mechanism,” Bazydlo and Kheirkhah said. “This is good! Issues appear when the whitelist is too broad though.”
A whitelist, or allow list, is distinct to a blocklist – aka blacklist – that attempts to list everything that should be blocked or prevented from running.
The researchers said Veeam’s deserialization allow list is based in part on a blocklist, which poses inherent challenges, since in any programming language, “the list of deserialization gadgets is actually pretty big,” especially as new functionality gets added.
While Veeam assigned a single CVE to the vulnerability the researchers discovered, they said that doesn’t encompass the full risk posed by what they found. “Simply put – you only need to find a deserialization gadget which is not blacklisted and leads to some potentially malicious impact” to gain remote code execution capabilities, the researchers said.
“Given the size of the Veeam codebase, we wouldn’t be surprised if other researchers now find numerous further feasible deserialization gadgets,” they said. “It is hard for us to be positive about this, given the criticality of the solution, combined with the well-known and trodden ground of this solution being targeted by ransomware gangs.”