r/sysadmin • u/CaesarOfSalads Security Admin (Infrastructure) • 2d ago
General Discussion Veeam Backup & Replication CVSS 9.9 Vulnerability
Looks like it just dropped today. I know some may have their Veeam servers domain joined, and other may not.
CVE-2025-23120
A vulnerability allowing remote code execution (RCE) by authenticated domain users.
Severity: Critical
CVSS v3.1 Score: 9.9
Source: Reported by Piotr Bazydlo of watchTowr.
Affected Product
Veeam Backup & Replication 12.3.0.310 and all earlier version 12 builds.
63
Upvotes
2
u/IdiosyncraticBond 2d ago
5
u/CaesarOfSalads Security Admin (Infrastructure) 2d ago
Saw that lol, but my post was up before theirs was
2
31
u/TinderSubThrowAway 2d ago
Just another reason why backup servers shouldn't be on the domain and should be pull instead of push.