Overview

Veeam has issued a security update to address a critical vulnerability (CVE-2025-23114) affecting its Veeam Updater component. This flaw allows attackers to execute arbitrary code remotely by leveraging a Man-in-the-Middle (MitM) attack. The vulnerability has a CVSS v3.1 score of 9.0, indicating a severe security risk. Users and administrators of affected products should update their software immediately to mitigate potential threats.

Technical Details

The vulnerability exists due to improper Transport Layer Security (TLS) certificate validation in the Veeam Updater component. Attackers can intercept and modify communication between the Veeam Backup server and update sources, enabling them to execute arbitrary code with root privileges. Given the high severity of this flaw, exploitation could lead to complete system compromise, data loss, or ransomware attacks.

Affected Products

The following Veeam Backup products contain the vulnerable Veeam Updater component:

Current Releases:

• Veeam Backup for Salesforce – Version 3.1 and older

Previous Releases:

• Veeam Backup for Nutanix AHV – Versions 5.0 and 5.1 (Fixed in v6 released on August 24, 2024)
• Veeam Backup for AWS – Versions 6a and 7 (Fixed in v8 released on July 2, 2024)
• Veeam Backup for Microsoft Azure – Versions 5a and 6 (Fixed in v7, released on July 2, 2024)
• Veeam Backup for Google Cloud – Versions 4 and 5 (Fixed in v6, released on December 3, 2024)
• Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization – Versions 3, 4.0, and 4.1 (Fixed in v5, released on August 24, 2024)

Mitigation and Patching

Veeam strongly advises users to update their systems immediately.

• For Veeam Backup for Salesforce, an additional update is required to secure the current version.
• Users of other affected products should ensure they are running the latest patched versions listed above.
• Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization users must update the appliance through the Veeam Backup & Replication Console.

Security Implications

The CVE-2025-23114 vulnerability is particularly concerning because it allows attackers to gain root access to affected servers. This level of access enables:

• Data exfiltration – Attackers can steal sensitive backup data.
• Ransomware deployment – Malicious actors can encrypt data and demand payment for its release.
• Lateral movement – Attackers can pivot within a compromised network to target additional systems.

Previous Veeam Vulnerabilities

This is not the first critical security flaw discovered in Veeam’s backup solutions:

• CVE-2024-40711 – A remote code execution (RCE) vulnerability in Veeam Backup & Replication with a CVSS score of 9.8 was actively exploited by ransomware groups like Fog and Akira.
• VSPC RCE Vulnerability – In December 2024, Veeam patched another critical RCE flaw in its Veeam Service Provider Console (VSPC).

Conclusion

The discovery of CVE-2025-23114 reminds us how critical it is to stay ahead of security threats. Organizations using Veeam backup solutions should waste no time in applying patches and verifying update authenticity to block potential MitM attacks. However, patching alone isn’t enough—security teams must also evaluate network defenses, strengthen endpoint security, and implement monitoring tools to catch suspicious activity early. Staying vigilant and taking a layered approach to security will help organizations reduce their exposure to cyber threats and keep their systems safe.

References:

• https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-011
• https://nvd.nist.gov/vuln/detail/CVE-2025-23114
• https://www.veeam.com/kb4712

Related

Disclaimer: This blog is based on our research and the information available at the time of writing. It is for informational purposes only and does not constitute legal, financial, or professional advice. While we strive for accuracy, we do not guarantee the completeness or reliability of the content. If any sensitive information has been inadvertently included, please contact us for correction. Cyble is not responsible for any errors, omissions, or decisions made based on this content. Readers should verify findings and seek expert advice where necessary. All trademarks, logos, and third-party content belong to their respective owners and do not imply endorsement or affiliation. All content is presented “as is” without any guarantee that it is free of confidential, proprietary, or otherwise sensitive information. If you believe any portion of this content contains inadvertently shared or sensitive data, please contact us immediately so that we may address and rectify the issue. No Liability for Errors or Omissions Due to the dynamic nature of cyber threat activity, this [blog/report/article] may include partial, outdated, or otherwise incorrect information due to unverified sources, evolving security threats, or human error. We expressly disclaim any liability for errors or omissions or any potential consequences arising from the use, misuse, or reliance on this information.