A critical flaw in Veeam Backup & Replication threatens the infrastructure organisations depend on to recover. Security leaders should prioritise remediation and verify that recovery remains dependable.

Source alert: 9 October 2026 · Technical details verified: 3 November 2026

When a cyberattack disrupts production systems, the backup environment becomes essential to restoring operations. A vulnerability that puts the backup server under an attacker’s control therefore deserves urgent attention from both IT operations and security leadership.

That is the concern behind CVE-2025-64393, a critical vulnerability in Veeam Backup & Replication. An attacker authenticated with the Backup Viewer role can exploit the flaw to execute arbitrary code as SYSTEM. Singapore’s Cyber Security Agency highlighted the issue in its 9 October 2026 alert and urged affected organisations to update immediately.

For CISOs, the response should establish two things: that affected systems have been remediated, and that the organisation can still recover its critical services with confidence.

The vulnerability at a glance

Technical details: Veeam KB4934 and the CSA alert.

How limited access becomes a serious compromise

The flaw involves insecure deserialisation of untrusted data received through the Mount Service. Deserialisation converts transmitted or stored data into objects an application can use. When that process handles untrusted input unsafely, it can create a path to code execution. In this case, the resulting execution occurs on the Veeam Backup Server.

The access requirement matters. Exploitation requires an authenticated identity with Backup Viewer permissions. Security teams should therefore include these accounts in their exposure review, alongside administrative identities.

SYSTEM execution gives malicious code extensive privileges on the Windows host. Microsoft describes LocalSystem as an account with broad local access, making this a substantial escalation from the permissions associated with a viewing role.

Why this belongs on the CISO’s agenda

From a risk-management perspective, control over a backup server creates opportunities to interfere with recovery. Depending on the environment, an attacker could disrupt backup services, alter accessible configurations or use the compromised host to reach other resources.

These potential consequences depend on the server’s permissions, network access and the protection of backup repositories. The assessment should examine how recovery would work if the backup server itself became untrusted, including access to protected copies, encryption keys and the systems needed to restore them.

Recovery confidence should rest on protected backup copies, controlled access and successful restoration tests.

What organisations should do now

1. Establish the exact exposure

Inventory every Veeam Backup & Replication deployment and record its full build number, including secondary recovery environments. In the Veeam console, the installed build is available under Help > About. Assign an owner to each affected instance so that remediation coverage can be verified.

2. Apply the update through an urgent, controlled change

Move affected installations to 12.3.2 P4, build 12.3.2.4934, or a later supported release that includes the fix. Follow Veeam’s installation requirements: the smaller patch applies to specified 12.3.2 builds, while earlier versions require the deployment ISO. Where Veeam Backup Enterprise Manager is used, Veeam instructs customers to update it first. Verify the resulting build and service health after installation.

3. Review access to the backup environment

Remove unnecessary role assignments and review the identities that retain Backup Viewer access. Include external support and service accounts where applicable. Restrict management connectivity to approved systems and networks, and enforce strong authentication on supported access paths. Use these measures to reduce exposure while completing the update.

4. Investigate suspicious activity

Ask the security operations team to review authentication events, unexpected role changes, unusual process activity on backup hosts and unexplained changes to backup jobs or retention settings. Treat these as general investigation leads. Where evidence suggests compromise, preserve relevant logs and activate the incident response process; remediation must also address any persistence or unauthorised changes already introduced.

5. Demonstrate that recovery works

Verify the availability and protection of recovery copies, including offline copies or immutable storage where implemented. Perform a representative restore in an isolated environment and confirm that the required keys, credentials and recovery documentation remain available. CISA’s ransomware guidance specifically recommends offline, encrypted backups and regular backup testing.

Protect the ability to recover

This advisory gives security leaders a concrete opportunity to test ownership across security, infrastructure and business continuity. The infrastructure team should demonstrate patch coverage, the security team should assess suspicious activity, and the recovery owner should provide evidence of a successful restore.

The objective is a recovery capability the business can trust when it needs it most.

References

• Veeam — Security advisory KB4934
• Veeam — Release information and update instructions, KB4696
• Cyber Security Agency of Singapore — Advisory dated 9 October 2026
• NIST National Vulnerability Database — CVE-2025-64393
• Microsoft Learn — LocalSystem Account
• CISA and MS-ISAC — Ransomware Guide