Introduction
If left unpatched, a single domain user account can now compromise the core of enterprise backup infrastructure. CVE-2025-48983 is a critical remote code execution vulnerability in Veeam Backup & Replication's Mount service, and it lets any authenticated domain user run arbitrary code on backup hosts. The risk is larger because Veeam holds a dominant position in the backup and disaster recovery market, with its software deployed in thousands of organizations worldwide. Veeam Backup & Replication protects data across virtual, physical, and cloud environments, so a vulnerability in one of its core services has a high impact across the industry.
Technical Information
CVE-2025-48983 is a remote code execution vulnerability in the Mount service of Veeam Backup & Replication. It affects version 12 and all earlier builds. The root cause is the .NET Remoting channel the Mount service uses for remote communication, which depends on object serialization and deserialization. Veeam tried to secure this with a custom binary formatter that accepts only a whitelist of allowed classes. The whitelist is too broad, though, and attackers can use gadget chains within whitelisted classes to achieve arbitrary code execution.
The only requirement is that the target Veeam Backup & Replication server is joined to an Active Directory domain. Any authenticated domain user can then connect to the Mount service and send a specially crafted serialized object. When the Mount service deserializes the object, it triggers the gadget chain, and the attacker's code runs with the privileges of the Mount service process. The attack is not possible in workgroup deployments or on the Veeam Software Appliance, and version 13 of Veeam Backup & Replication is not affected.
CVE-2025-48983 is closely related to CVE-2025-48984, which affects the Backup Server component and uses similar exploitation techniques. Both show the risk of unsafe deserialization in .NET applications that rely on blacklists or overly permissive whitelists. Previous research and advisories have shown that these approaches do not prevent exploitation, because attackers can often find exploitable gadget chains in the allowed classes.
Patch Information
Veeam has fixed critical vulnerabilities in Backup & Replication in version 12.3.2.4165. The update is essential for mitigating the remote code execution (RCE) and local privilege escalation (LPE) vulnerabilities identified in earlier versions.
Key Vulnerabilities Addressed:
-
CVE-2025-48983: A critical flaw in the Mount service that lets authenticated domain users execute arbitrary code on backup infrastructure hosts.
-
CVE-2025-48984: A critical vulnerability that lets authenticated domain users perform RCE on the Backup Server.
-
CVE-2025-48982: A high-severity issue in Veeam Agent for Microsoft Windows that could lead to LPE if an administrator restores a malicious file.
Patch Implementation:
To apply the update:
-
Download the latest version (12.3.2.4165) from the official Veeam website.
-
Before you upgrade, make sure you have a complete backup of your current configuration and data.
-
Run the installer and follow the on-screen instructions to complete the upgrade.
-
After installation, check the version number to confirm the update succeeded.
Additional Recommendations:
-
After the update, review your system settings against security best practices.
-
Watch system logs and performance metrics for anomalies.
-
Check regularly for new updates and advisories from Veeam.
Applying this patch promptly significantly reduces the risk of exploitation.
For full details, see Veeam's official advisory: Veeam KB4771.
Affected Systems and Versions
CVE-2025-48983 affects the following:
- Veeam Backup & Replication version 12.3.2.3617 and all earlier version 12 builds
- Only backup infrastructure servers that are joined to an Active Directory domain
- Workgroup-based deployments and Veeam Software Appliances are not affected
- Veeam Backup & Replication version 13 is not affected
Vendor Security History
Veeam Backup & Replication has had several critical vulnerabilities in recent years. CVE-2024-40711 and CVE-2025-23120 were both critical deserialization vulnerabilities that allowed remote code execution. Veeam typically responds quickly to reported issues and releases patches and advisories in coordination with security researchers. The recurrence of similar vulnerabilities, however, suggests the product needs architectural changes, and Veeam has indicated that version 13 makes them.
