Critical Veeam Backup & Replication Flaw Allows Low-Privileged Users to Execute Remote Code

Veeam released security updates (notably 12.3.2 P4 build 12.3.2.4934) to fix a critical insecure-deserialization vulnerability (CVE-2025-64393, CVSS v4.0 9.4) in Backup & Replication that can allow low-privileged authenticated Backup Viewer accounts to execute remote code on backup servers; the advisory also addresses three additional CVEs impacting Cloud Connect, Enterprise Manager, and backup-server data, and urges customers to verify builds, apply patches (or full ISOs for older 12.3.x releases), update Enterprise Manager first, and note version 12 support ends 2027-02-28.