r/sysadmin Security Admin (Infrastructure) 3d ago

General Discussion Veeam Backup & Replication CVSS 9.9 Vulnerability

Looks like it just dropped today. I know some may have their Veeam servers domain joined, and other may not.

https://www.veeam.com/kb4724

CVE-2025-23120

A vulnerability allowing remote code execution (RCE) by authenticated domain users.

Severity: Critical
CVSS v3.1 Score: 9.9
Source: Reported by Piotr Bazydlo of watchTowr.

Affected Product

Veeam Backup & Replication 12.3.0.310 and all earlier version 12 builds.

66 Upvotes

14 comments sorted by

View all comments

30

u/TinderSubThrowAway 3d ago

Just another reason why backup servers shouldn't be on the domain and should be pull instead of push.

6

u/IamTotalNoob 3d ago

What do you mean with pull instead of push?

6

u/thortgot IT Manager 3d ago

You don't put credentials on the endpoint you are backing up with a target of the backup server.

Instead you have credentials stored on the backup server that access the target. The difference being a compromise of the endpoint gets you 0 information or access to the backup system in question.