Une vulnérabilité dans le service Mount de Veeam Backup & Replication, qui permet une exécution de code à distance (RCE) sur les hôtes d'infrastructure de sauvegarde par un utilisateur de domaine authentifié.

The impact of CVE-2025-48983 is severe. Successful exploitation allows an attacker, possessing valid domain user credentials, to execute arbitrary code with the privileges of the Mount service on the Backup infrastructure host. This could enable attackers to gain persistent access, steal sensitive data (including backups), disrupt operations, or even pivot to other systems within the network. Given Veeam's role in data protection, a compromise could have devastating consequences for data recovery and business continuity. The ability to execute code on the backup infrastructure represents a significant escalation of privilege, potentially granting access to highly sensitive data and systems.

Organizations heavily reliant on Veeam Backup & Replication for data protection are particularly at risk. This includes businesses with large backup repositories, those utilizing Veeam for disaster recovery, and those with complex Active Directory environments where domain user accounts may have excessive privileges. Shared hosting environments utilizing Veeam Backup & Replication also present a heightened risk due to potential cross-tenant vulnerabilities.

• windows / supply-chain:

Get-Process -Name 'mount'
Get-WinEvent -LogName Application -Filter "EventID = 1000 -Message '*Veeam Backup & Replication* Mount service*error*'"

• linux / server:

ps aux | grep 'mount'
journalctl -u veeam-mount-service

• generic web: Check Veeam Backup & Replication server's firewall rules to ensure only authorized access to the Mount service is permitted.

1. 2025-10-30Disclosure

   disclosure

1. Réservé2025-05-29
2. Publiée2025-10-30
3. Modifiée2026-02-26
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-48983 is to upgrade to a patched version of Veeam Backup & Replication as soon as it becomes available. Until the patch is applied, consider restricting access to the Mount service and implementing strict authentication controls for domain users. Monitor the Mount service logs for any suspicious activity. While a direct workaround is unlikely, segmenting the backup infrastructure network and limiting lateral movement capabilities can reduce the potential blast radius of a successful attack. After upgrade, confirm by verifying the version number and reviewing Veeam's security advisory for confirmation of successful patching.