Infoseccers criticize Veeam over critical RCE vulnerability and a failing blacklist

In patching the latest critical remote code execution (RCE) bug in Backup and Replication, software shop Veeam is attracting criticism from researchers for the way it handles uncontrolled deserialization vulnerabilities. The vendor patched the near-maximum severity CVE-2025-23120 (9.9) on March 19, which can be exploited by any authenticated domain user provided the Veeam server is domain-joined. It affects Backup and Replication 12.3.0.310 and all earlier versions, Veeam said – all supported releases. Usually, when vulnerabilities require authentication before the bad stuff can happen, The Register pops a big warning – a caveat – near the top of a report communicating that fact. They're typically not as dangerous as their pre-auth cousins. However, the severity score speaks for itself, and as watchTowr's Piotr Bazydlo noted in his analysis of the bug, "the authentication requirement is fairly weak." He's referring to the fact that any domain user can exploit the bugs, provided the organization in question doesn't have a hardened Active Directory configuration. Veeam tries to pass some blame onto users by saying the B&R server should never be domain-joined as it goes against its best practices, but as many have already pointed out, barely anyone seems to be aware of this. Also, as Bazydlo and Rapid7 highlighted, Veeam B&R is routinely targeted by ransomware groups, who are usually resourceful enough to gain access to at least one user account within an organization. Further, ...