CVE-2025-64393: Critical severity Veeam Backup & Replication vulnerability
Published Oct 7, 2026
·Updated
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
Affected Software
1 affected component
Veeam Backup & Replication
Event History
Oct 7, 2026
CVE Published
via MITRE·08:48 AM
Data Sourced
via MITRE·08:48 AM
DescriptionWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker must have Backup Viewer privileges in Veeam Backup & Replication. No user interaction is required, and the listed attack vector is network-based.
2
What is the impact of successful exploitation?
A Backup Viewer can execute arbitrary code as SYSTEM on the backup server. This can result in complete compromise of the affected backup server, including confidentiality, integrity, and availability impacts.
3
How should organizations prioritize remediation?
Treat this as critical because exploitation is assessed as low complexity and can yield SYSTEM-level code execution. Prioritize systems where Backup Viewer access is assigned and review that role's membership while applying the vendor guidance in KB4934.