Veeam CVE-2025-64393: a Backup Viewer can run code on the backup server, in version 12 only Veeam's advisory KB4934 of 6 October 2026 says a low-privileged user with the Backup Viewer role can perform remote code execution on the Veeam Backup Server through insecure deserialization (CVE-2025-64393, Critical, CVSS 4.0 9.4, Veeam's own score). Affected: version 12 builds up to 12.3.2.4854; fixed in 12.3.2.4934; version 13 is not affected. Veeam's own v12 guide describes the role as read-only console access, and no workaround is listed. "As SYSTEM" is the CVE record's wording, not Veeam's. 🧮 Four issues in the release; the Cloud Connect file read (CVE-2026-58069, High 8.3) was fixed in version 13 builds on 29 July and 25 August, and in version 12 on 6 October: 69 and 42 days later (derived). CVE-2025-64393 was reserved on 31 October 2025 and published 7 October 2026, 341 days later (derived), so the 2025 is the reservation year. Three of the four need a role or a tenant login; the control is who holds the role and what can reach the console. 🔍 Not established: any exploitation (CISA's catalogue lists none of the four, only four older Veeam flaws all flagged for ransomware use; Veeam's pages say nothing on exploitation), how an account comes to hold Backup Viewer, which files the Cloud Connect flaw exposes, and any detection guidance. A report that these were in the catalogue is wrong. ⚖️ UK: Cyber Essentials v3.3 allows 14 days from release. Veeam's pages disagree on the version 12 build date (6 October on three pages, 29 September in the build table), so the deadline is 20 October, or 13 October if the earlier date is right. Version 12 reaches end of support on 28 February 2027, 139 days from now (derived). MSPs running Cloud Connect for UK clients: who patches the provider host, and how fast? 🔑 Which accounts and groups hold Backup Viewer on your backup server today, and who put them there? Full briefing: https://www.pk-sharma.com/briefing/veeam-cve-2025-64393-backup-viewer-can-run-code-on-backup-server-version-12-only-cloud-connect-file-read #Veeam #Backup #Ransomware #CVE202564393 #CloudConnect #MSP #PatchManagement #CyberEssentials #NCSC #VulnerabilityManagement #ThreatIntel #InfoSec #CyberSecurity #UKTech