Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN982
_____________________________________________________________________

DATE                : 07/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Veeam Backup & Replication
                  versions prior to 12.3.2 P4 (build 12.3.2.4934).

====================================================================
https://www.veeam.com/kb4934
_____________________________________________________________________


Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4
KB ID: 	4934
Product: 	Veeam Backup & Replication | 12 | 12.1 | 12.2 | 12.3 
                                           | 12.3.1 | 12.3.2
Published: 	2026-10-06
Last Modified: 	2026-10-06

By subscribing, you are agreeing to have your personal information
managed in accordance with the terms of Veeam's Privacy Notice.


Article Applicability

All vulnerabilities listed in this article:

    Affect only Veeam Backup & Replication 12.3.2 P3 (build 12.3.2.4854) and older builds.
    Are resolved in Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934).
    Do not affect any Veeam Backup & Replication version 13 builds.

Customers are reminded that Veeam Backup & Replication version 12 will
reach End of Support on 2027-02-28.

Veeam Software Security Commitment
Veeam® is committed to ensuring its products protect customers from
potential risks. As part of that commitment, we operate a Vulnerability
Disclosure Program (VDP) for all Veeam products and perform extensive
internal code audits. When a vulnerability is identified, our team
promptly develops a patch to address and mitigate the risk. In line
with our dedication to transparency, we publicly disclose the
vulnerability and provide detailed mitigation information. This
approach ensures that all potentially affected customers can quickly
implement the necessary measures to safeguard their systems. It’s
important to note that once a vulnerability and its associated patch
are disclosed, attackers will likely attempt to reverse-engineer
the patch to exploit unpatched deployments of Veeam software. This
reality underscores the critical importance of ensuring that all
customers use the latest versions of our software and install all
updates and patches without delay.

Issue Details


CVE-2025-64393

A vulnerability allowing a low-privileged user with the Backup Viewer
role to perform remote code execution (RCE) on the Veeam Backup
Server through insecure deserialization of untrusted data received
via the Mount Service.

Severity: Critical
CVSS v4.0 Score: 9.4
Source: Reported through HackerOne.


Affected Product

    Veeam Backup & Replication 12.3.2.4854 and all earlier version
12 builds.
    Note: Version 13 is not affected.


Solution

This vulnerability was fixed starting in the following build:

    Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934)


CVE-2026-93026

A vulnerability allowing an authenticated user with the Backup
Viewer role to modify or delete the Enterprise Manager master
key and read or overwrite stored antivirus update credentials
on the Veeam Backup Server.

Severity: Medium
CVSS v4.0 Score: 6.1
Source: Reported through HackerOne.

Affected Product

    Veeam Backup & Replication 12.3.2.4854 and all earlier
version 12 builds.
    Note: Version 13 is not affected.

Solution

This vulnerability was fixed starting in the following build:

    Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934)


CVE-2025-64392

A reflected cross-site scripting vulnerability in Veeam Backup
Enterprise Manager allows an attacker to execute script in the
browser of an authenticated portal user who opens a crafted
link.

Severity: Medium
CVSS v4.0 Score: 4.8
Source: Reported through HackerOne.
Affected Product

    Veeam Backup Enterprise Manager (Veeam Backup & Replication)
12.3.2.4854 and all earlier version 12 builds.
    Note: Version 13 is not affected.

Solution

This vulnerability was fixed starting in the following build:

    Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934)



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================