CVE-2025-23120: Critical Remote Code Execution Vulnerability in Veeam Backup & Replication

On March 19, 2025, Veeam published a security advisory for a critical severity vulnerability impacting their Backup & Replication software. The advisory did not provide technical details regarding the vulnerability, although it did mention that it could be exploited by authenticated domain users. 

On March 20, 2025, watchTowr Labs released a technical report detailing the vulnerability and providing proof-of-concept (PoC) exploit code. In the report, watchTowr specified that the vulnerability can be exploited by any user that belongs to the same local users group as the Windows device hosting a Veeam server. Additionally, if the server has been joined to an Active Directory (AD) domain, any domain user can exploit the vulnerability. They state that CVE-2025-23120 is very similar to a previous vulnerability, CVE-2024-40711, a deserialization of untrusted data vulnerability with a malicious payload which can allow for RCE in Veeam Backup & Replication. The PoC provided in the article uses an exploit for CVE-2024-40711 with slight alterations to update it for CVE-2025-23120. 

Historically Veeam Backup & Replication has been a frequent target for ransomware groups due to its critical role in backup and recovery. Arctic Wolf previously reported Veeam addressing multiple vulnerabilities in a September 2024 security bulletin. 

Recommendation for CVE-2025-23120

Upgrade to Latest Fixed Version

Arctic Wolf strongly recommends that customers upgrade to the latest fixed version of Veeam Backup & Replication. 

Please follow your organization’s patching and testing guidelines to minimize potential operational impact. 

References 

• Security Advisory

• Exploitation Details

• PoC

Resources

Understand the threat landscape, and how to better defend your organization, with the 2025 Arctic Wolf Threat Report

See how Arctic Wolf utilizes threat intelligence to harden your attack surface and stop threats earlier and faster