Veeam Backup & Replication RCE via domain auth

Published9 June 2026 Vorant ratingelevated vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

CVE-2025-23120 allows authenticated domain users to execute arbitrary code on domain-joined Veeam Backup & Replication servers, risking backup compromise.

Sourcecisecurity.org — open the original

What to check

Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

A remote code execution vulnerability has been disclosed in Veeam Backup & Replication that affects systems running version 12.3.0.310 and all earlier version 12 builds. CVE-2025-23120 can be exploited by authenticated domain users when the backup server is joined to an Active Directory domain—a configuration Veeam explicitly discourages in their security best practices but acknowledges may still be common in production environments.

Successful exploitation allows an attacker with domain credentials to execute arbitrary code on the backup server, potentially compromising sensitive backup data and disaster recovery images. The vulnerability leverages software deployment mechanisms within the domain-joined environment. While MS-ISAC reports no evidence of active exploitation in the wild, the criticality of backup infrastructure and the relatively low barrier to exploitation make this a high-priority remediation target.

Organizations are advised to apply vendor patches immediately after testing, ensure backup servers are not domain-joined per Veeam's guidance, implement network segmentation to isolate backup infrastructure, and enforce multi-factor authentication for administrative access. The impact is particularly severe for organizations that have not followed vendor hardening recommendations.

Mentioned in this report

Vulnerabilities CVE-2025-23120

Detection guidance

Suspicious Child Process Spawned by Veeam Backup Service

ATT&CK T1072 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects command interpreters or scripting engines spawned as children of Veeam Backup & Replication service processes, consistent with RCE exploitation via CVE-2025-23120. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned by Veeam Backup Service
id: baf87812-7d9d-50dd-b67a-ace88b490385
status: experimental
description: 'Detects command interpreters, scripting engines, or LOLBins launched
  as child processes of Veeam Backup & Replication service processes. Veeam service
  processes should not normally spawn shells or scripting hosts; this pattern is consistent
  with exploitation of CVE-2025-23120, which allows authenticated domain users to
  achieve remote code execution on domain-joined Veeam backup servers.

  '
references:
- https://www.veeam.com/kb4649
author: Vorant
tags:
- attack.t1072
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - Veeam.Backup.Service.exe
    - Veeam.Backup.MountService.exe
    - Veeam.Backup.Manager.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
    - \rundll32.exe
    - \regsvr32.exe
  filter_known_admin:
    CommandLine|contains:
    - Veeam.Backup.Manager.exe -RunAsAdmin
  condition: selection_parent and selection_child and not filter_known_admin
falsepositives:
- Legitimate Veeam pre/post backup job scripts configured by administrators to run
  PowerShell or batch scripts
- Scheduled maintenance scripts invoked by Veeam job hooks
level: high

Veeam Backup Service Process Executing Encoded or Remote Commands

ATT&CK T1072 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects Veeam backup service processes launching command interpreters with base64-encoded or download/execute style command lines, indicating likely post-exploitation activity after RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Veeam Backup Service Process Executing Encoded or Remote Commands
id: a8c33f5a-69ba-553d-9437-74ff1ed10dfd
status: experimental
description: 'Detects PowerShell or cmd.exe processes spawned by Veeam Backup & Replication
  service binaries with command lines containing encoded commands, download cradles,
  or remote execution flags. This behaviour is consistent with post-exploitation activity
  following successful abuse of CVE-2025-23120 on domain-joined Veeam servers.

  '
references:
- https://www.veeam.com/kb4649
author: Vorant
tags:
- attack.t1072
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - Veeam.Backup.Service.exe
    - Veeam.Backup.MountService.exe
    - Veeam.Backup.Manager.exe
  selection_encoded:
    CommandLine|contains:
    - '-enc '
    - -EncodedCommand
    - FromBase64String
    - DownloadString
    - 'IEX '
    - Invoke-Expression
  condition: selection_parent and selection_encoded
falsepositives:
- Custom Veeam automation scripts that legitimately use encoded PowerShell for job
  orchestration (rare in most environments)
level: high

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-veeam-backup-replication-could-allow-for-arbitrary-code-execution_2025-029

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs