Critical Vulnerability in Veeam Backup Allows Remote Code Execution

Veeam has released patches for a critical remote code execution vulnerability (CVE-2025-64393, CVSS 9.4) in Backup & Replication affecting builds up to 12.3.2.4854; exploitation requires an authenticated Backup Viewer account and leverages insecure deserialization via the Mount Service. Version 13 is not affected, three other vulnerabilities of medium-to-high severity were fixed in the same update, and Veeam reports no confirmed in-the-wild exploitation — administrators should verify installed builds and apply updates promptly.