Veeam Backup & Replication and Veeam Agent for Windows Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Veeam Backup & Replication versions 12.3.1.1139 and earlier, as well as in Veeam Agent for Microsoft Windows versions 6.3.1.1074 and earlier. This vulnerability allows an authenticated domain user to execute arbitrary code on the backup server. It is important to note that this issue only affects domain-joined backup servers.

Impact

Exploitation of this vulnerability allows for remote code execution on the backup server, with the executed code running in the context of the application.

Remediation

Users can upgrade to Veeam Backup & Replication 12.3.2 (build 12.3.2.3617) or Veeam Agent for Microsoft Windows 6.3.2 (build 6.3.2.1205) to address this vulnerability.