Platform
windows
Component
mount-service
Fixed in
12.3.3
CVE-2025-48983 represents a critical Remote Code Execution (RCE) vulnerability discovered in the Mount service of Veeam Backup & Replication. This flaw allows an authenticated domain user to execute arbitrary code on the Backup infrastructure hosts, potentially leading to complete system compromise. The vulnerability impacts Veeam Backup & Replication version 12.3.2, and a patch is expected to be released by Veeam.
The impact of CVE-2025-48983 is severe. Successful exploitation allows an attacker, possessing valid domain user credentials, to execute arbitrary code with the privileges of the Mount service on the Backup infrastructure host. This could enable attackers to gain persistent access, steal sensitive data (including backups), disrupt operations, or even pivot to other systems within the network. Given Veeam's role in data protection, a compromise could have devastating consequences for data recovery and business continuity. The ability to execute code on the backup infrastructure represents a significant escalation of privilege, potentially granting access to highly sensitive data and systems.
The vulnerability is currently publicly known, and while no active exploitation campaigns have been confirmed, the CRITICAL severity and RCE nature suggest a high likelihood of exploitation. The vulnerability has been added to the CISA KEV catalog, indicating a significant risk to US critical infrastructure. Public proof-of-concept (POC) code is anticipated, increasing the risk of widespread exploitation. The vulnerability's reliance on domain user authentication may limit exploitation to environments with compromised or poorly secured domain accounts.
Exploit Status
EPSS
0.25% (48% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-48983 is to upgrade to a patched version of Veeam Backup & Replication as soon as it becomes available. Until the patch is applied, consider restricting access to the Mount service and implementing strict authentication controls for domain users. Monitor the Mount service logs for any suspicious activity. While a direct workaround is unlikely, segmenting the backup infrastructure network and limiting lateral movement capabilities can reduce the potential blast radius of a successful attack. After upgrade, confirm by verifying the version number and reviewing Veeam's security advisory for confirmation of successful patching.
Update Veeam Backup & Replication to a version later than 12.3.2 to fix the remote code execution (RCE) vulnerability. See the Veeam knowledge base article (KB4771) for more details and specific upgrade instructions.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-48983 is a critical Remote Code Execution vulnerability in Veeam Backup & Replication 12.3.2, allowing authenticated domain users to execute code on Backup infrastructure hosts.
If you are running Veeam Backup & Replication version 12.3.2, you are potentially affected by this vulnerability. Upgrade as soon as a patch is available.
The recommended fix is to upgrade to a patched version of Veeam Backup & Replication. Monitor Veeam's website for the official patch release.
While no active exploitation campaigns have been confirmed, the CRITICAL severity and RCE nature suggest a high likelihood of exploitation. Monitor your systems closely.
Refer to the official Veeam Security Advisories page on the Veeam website for the latest information and patch details.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.