June 18, 2025 By Pierluigi Paganini
Veeam addressed a new critical flaw in Backup & Replication product that could potentially result in remote code execution.
Veeam has rolled out security patches to address a critical security vulnerability, tracked CVE-2025-23121 (CVSS score of 9.9) in its Backup & Replication solution that can allow remote attackers to execute arbitrary code under certain conditions.
“A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.” reads the advisory published by the vendor.
The vulnerability impacts Backup & Replication 12.3.1.1139 and all earlier version 12 builds.
Researchers at CODE WHITE GmbH and watchTowr have reported the vulnerability to the company.
Rapid7 researchers, in a technical analysis of the bug, reported that after the patch for CVE-2025-23120 was released in March 2025, researchers revealed it could be bypassed leading to CVE-2025-23121. Veeam’s June 17 advisory rates it 9.9 CVSS and confirms that authenticated domain users can exploit it, mirroring the conditions of the earlier CVE.
“CVE-2025-23121 is credited to security researchers at CODE WHITE GmbH and watchTowr. In March 2025, following the release of the patch for Veeam Backup & Replication’s CVE-2025-23120, these researchers publicly stated that the patch for CVE-2025-23120 could be bypassed.” reported Rapid7. “Veeam’s June 17 advisory states that CVE-2025-23121 is authenticated, the CVSS score is 9.9, and “authenticated domain users” can exploit the vulnerability; all of these details align with the advisory for CVE-2025-23120.”
