CVE-2025-64393 – Veeam Backup and Replication

CVSS 9.4 CRITICAL [2] Critical – Same Day Deployment

“When a read-only backup viewer can take over the backup server as SYSTEM, your last line of defense becomes the attacker's front door.”

Veeam's update for Backup and Replication fixes two serious flaws in the system organizations depend on to recover from ransomware and outages. CVE-2025-64393 has a CVSS score of 9.4, Critical severity. It lets a user with only the Backup Viewer role run arbitrary code as SYSTEM on the backup server, which turns a low-privilege, view-only account into full control of the backup infrastructure.

CVE-2026-58069 has a CVSS score of 8.3, High severity. It lets an authenticated Cloud Connect tenant read arbitrary files on the service provider host, which exposes provider data and other tenants' data to any customer account. Together, these flaws threaten backup integrity, and service providers running Cloud Connect face the most exposure.

Key Details

CWE Classification: CWE-502

Patch this CVE on all your endpoints in under 5 minutes. First 200 endpoints are free forever, scale as needed.