--- title: Vulnerability in Veeam Backup & Replication (CVE-2025-23120) description: Critical Remote Code Execution Vulnerability in Veeam Backup & Replication (CVE-2025-23120) image: https://www.coolspirit.co.uk/hubfs/Arctic%20Wolf%20PR.jpg --- # Bulletin: Veeam Backup and Replication ![](https://www.coolspirit.co.uk/hubfs/website/images/curves/hero/pngs/hero-curve-white.png) ## Vulnerability in Veeam Backup & Replication (CVE-2025-23120) Written on: ** Mar 21, 2025 11:44:30 AM ** Written by: ** Alex Raben ** Topic [Data Management, Data Security, COOLSPIRiT] Share this post: Critical Remote Code Execution Vulnerability in Veeam Backup & Replication (CVE-2025-23120) Proof-of-concept (PoC) exploit code has been made publicly available for CVE-2025-23120, a critical severity remote code execution vulnerability affecting Veeam Backup & Replication. If your organization uses Veeam Backup & Replication, we strongly recommend reviewing this bulletin and taking the necessary steps to mitigate the associated risk. ** Summary** On March 19, 2025, Veeam published a security advisory for a critical severity vulnerability impacting their Backup & Replication software. The advisory did not provide technical details regarding the vulnerability, although it did mention that it could be exploited by authenticated domain users.  On March 20, 2025, watchTowr Labs released a technical report detailing the vulnerability and providing proof-of-concept (PoC) exploit code. In the report, watchTowr specified that the vulnerability can be exploited by any user that belongs to the same local users group as the Windows device hosting a Veeam server. Additionally, if the server has been joined to an Active Directory (AD) domain, any domain user can exploit the vulnerability. They state that CVE-2025-23120 is very similar to a previous vulnerability, CVE-2024-40711, a deserialization of untrusted data vulnerability with a malicious payload which can allow for RCE in Veeam Backup & Replication. The PoC provided in the article uses an exploit for CVE-2024-40711 with slight alterations to update it for CVE-2025-23120.  Historically Veeam Backup & Replication has been a frequent target for ransomware groups due to its critical role in backup and recovery. Arctic Wolf previously reported Veeam addressing multiple vulnerabilities in a September 2024 security bulletin.  **Recommendation** Upgrade to Latest Fixed Version  Arctic Wolf strongly recommends that customers upgrade to the latest fixed version of Veeam Backup & Replication.  Product            Veeam Backup & Replication Affected Version 12.3.0.310 and all earlier version 12 builds     Fixed Version 12.3.1 (build 12.3.1.1139)  Please follow your organization's patching and testing guidelines to minimize potential operational impact.  **References** - Security Advisory: [https://www.veeam.com/kb4724](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGZVDtKp997-K8TieOhpjTPkvJUD4hiNvRo7A0bXtb6tw80tnHPSFEO-uo00bvAayTuIjUEALQ=) - Exploitation Details: [https://labs.watchtowr.com/by-executive-order-we-are-banning-blacklists-domain-level-rce-in-veeam-backup-replication-cve-2025-23120/](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGZVDtKp9KrIPl_OlG6Z6pPJbVvmuLhBvzu9jvQqTjIgiOGo0MsPFZItiv0CfsIG9WR6tX9lp0=) - PoC: [https://github.com/watchtowrlabs/CVE-2024-40711?ref=labs.watchtowr.com](https://go.arcticwolf.com/ODQwLU9TUS02NjEAAAGZVDtKp2VWiUPcAVJ5yOVuB-i0ovDL9CTN1V_334JGzwRw-r9QgAyoZQSx-wimYTO5Ubr4M-U=)   --- Article Information Source: Artic Wolf If you need further advice or help contact us today: [hello@coolspirit.co.uk](mailto:hello@coolspirit.co.uk) ![](https://www.coolspirit.co.uk/hubfs/website/images/curves/top/top-curve-dark-blue.svg) ## Discover our latest insights #### Enhance your knowledge by browsing our extensive library of case studies, brief sheets, data sheets, ebooks and white papers. If you have any immediate queries or requests, why not reach out to our team? [Explore now ](https://www.coolspirit.co.uk/insights) ###### Solutions [![Aqua-angle](https://www.coolspirit.co.uk/hs-fs/hubfs/Aqua-angle.png?width=27&height=6&name=Aqua-angle.png)](https://www.coolspirit.co.uk/partners) [Partners](https://www.coolspirit.co.uk/partners) [Hybrid Infrastructure](https://www.coolspirit.co.uk/solutions/hybrid-infrastructure) [Data Management](https://www.coolspirit.co.uk/solutions/data-management) [Networking](https://www.coolspirit.co.uk/solutions/networking) [Cloud](https://www.coolspirit.co.uk/solutions/cloud) [Cyber Security](https://www.coolspirit.co.uk/solutions/cyber-security) [DevOps](https://www.coolspirit.co.uk/solutions/devops) [GUARDiAN](https://www.coolspirit.co.uk/solutions/guardian) ###### Insights [![Aqua-angle](https://www.coolspirit.co.uk/hs-fs/hubfs/Aqua-angle.png?width=27&height=6&name=Aqua-angle.png)](https://www.coolspirit.co.uk/partners) [Blog](https://www.coolspirit.co.uk/blogs) [Case Studies](https://www.coolspirit.co.uk/case-studies) [Ebooks](https://www.coolspirit.co.uk/ebooks) [Data Sheets](https://www.coolspirit.co.uk/data-sheets) [Brief Sheets](https://www.coolspirit.co.uk/brief-sheets) [White Papers](https://www.coolspirit.co.uk/white-papers) ###### About Us [![Aqua-angle](https://www.coolspirit.co.uk/hs-fs/hubfs/Aqua-angle.png?width=27&height=6&name=Aqua-angle.png)](https://www.coolspirit.co.uk/partners) [Our Process](https://www.coolspirit.co.uk/about-us/our-process) [Accreditations](https://www.coolspirit.co.uk/accreditations) [Sustainability](https://www.coolspirit.co.uk/sustainability) [Social Responsibility](https://www.coolspirit.co.uk/social-responsibility) [International Shipping](https://www.coolspirit.co.uk/about/delivery-shipping) [Financing](https://www.coolspirit.co.uk/about/financing-plans) [G-Cloud 14 Framework](https://www.coolspirit.co.uk/g-cloud-14-framework) [News](https://www.coolspirit.co.uk/news) [Events](https://www.coolspirit.co.uk/events) [Contact](https://www.coolspirit.co.uk/contact-us) ###### Support [![Aqua-angle](https://www.coolspirit.co.uk/hs-fs/hubfs/Aqua-angle.png?width=27&height=6&name=Aqua-angle.png)](https://www.coolspirit.co.uk/partners) [GUARDiAN Support](https://www.coolspirit.co.uk/support/guardian-support) [Infrastructure Support](https://www.coolspirit.co.uk/support/infrastructure-support) ###### Get in Touch [![Aqua-angle](https://www.coolspirit.co.uk/hs-fs/hubfs/Aqua-angle.png?width=27&height=6&name=Aqua-angle.png)](https://www.coolspirit.co.uk/partners) T: 01246 454 222 E: [hello@coolspirit.co.uk](mailto:hello@coolspirit.co.uk) Follow us:  [Receive our newsletter ](https://www.coolspirit.co.uk/contact-us?hsLang=en) ![ISO Certifications Condensed 2025](https://www.coolspirit.co.uk/hs-fs/hubfs/ISO%20Certifications%20Condensed%202025.png?width=588&height=58&name=ISO%20Certifications%20Condensed%202025.png) COOLSPIRiT BSI Cert. Nos: FS 550303, IS 733967, EMS 753310, ITMS 764053 Registered in England No: 3600170 All rights reserved. | Copyright © COOLSPIRiT Ltd 2024 | [Cookie Policy](https://www.coolspirit.co.uk/cookie-policy?hsLang=en) | [Privacy Policy](https://www.coolspirit.co.uk/privacy-policy?hsLang=en) | [Modern Slavery Statement](https://www.coolspirit.co.uk/modern-slavery-statement)