Swiss SME Cyber Alert: Veeam Backup & Replication – read-only role can compromise the backup server
Veeam has fixed a critical vulnerability in Backup & Replication version 12. A signed-in account with the low-privilege Backup Viewer role can use it to execute code on the Veeam Backup Server. Organisations using Veeam should ask their IT provider to confirm that at least 12.3.2 P4 is installed, or that the environment already runs version 13.
What happened?
On 6 October 2026, Veeam released update 12.3.2 P4. CVE-2025-64393 affects the Mount Service: an authenticated user with the Backup Viewer role can trigger remote code execution on the backup server through insecure deserialization of untrusted data. The vulnerability is rated critical with a CVSS 4.0 score of 9.4.
Could my organisation be affected?
Veeam Backup & Replication 12.3.2 P3 build 12.3.2.4854 and all earlier version 12 builds are affected. According to Veeam, version 13 is not affected. Veeam is widely used for on-premises server, Hyper-V and VMware backups, including environments managed by external IT providers.
What should you do now?
Ask your IT provider to verify the installed Veeam version and full build number. Version 12 systems should be updated to 12.3.2 P4, build 12.3.2.4934, or moved to version 13 after appropriate planning. Unnecessary Backup Viewer accounts and their permissions should also be reviewed.
How urgent is it?
Urgent. Exploitation requires a valid account with the Backup Viewer role; this is not a pre-authentication attack. However, because the flaw allows code execution on the central backup server and a fix is available, the update should be applied promptly. Veeam does not report active exploitation in the advisory.
Information for your IT provider
Advisory: Veeam KB4934. CVE: CVE-2025-64393. Affected: Veeam Backup & Replication 12.3.2.4854 and all earlier version 12 builds. Fix: 12.3.2 P4, build 12.3.2.4934. Version 13 is not affected.
