Veeam’s Bug Blunder: How to Lose Friends and Annoy Researchers in One Patch
Veeam patches a critical RCE bug, CVE-2025-23120, but faces backlash for its vulnerability handling. Researchers criticize its blacklist approach, noting that any domain user can exploit the flaw if Active Directory isn’t hardened. Veeam claims domain-joining goes against best practices, but few seem aware.
Key Points:
- Veeam patched a critical remote code execution bug (CVE-2025-23120) in their Backup and Replication software but faces criticism for handling deserialization vulnerabilities poorly.
- The vulnerability affects version 12.3.0.310 and earlier, and requires only minimal authentication—any domain user can exploit it.
- Researchers criticize Veeam’s blocklist-based approach to deserialization vulnerabilities and recommend using a whitelist instead.
- Veeam is scolded for assigning only one CVE identity despite discovering multiple exploitable gadgets.
- Ransomware groups frequently target Veeam, and 20% of Rapid7’s incident responses in 2024 involved Veeam exploitation.
Already a member? Log in here