National CERT Issues High Alert Over Critical Veeam Backup Vulnerability

The National Computer Emergency Response Team (CERT) has issued a high-level security advisory warning organizations of a critical Remote Code Execution (RCE) vulnerability in Veeam Backup & Replication (VBR) software. The flaw, tracked as CVE-2025-23121 and carrying a severity score of 9.9 on the CVSS v3.0 scale, affects VBR versions 12.0 through 12.3.1.

The vulnerability allows any authenticated domain user to remotely execute arbitrary code on domain-joined backup servers, potentially compromising entire backup environments.

According to the National CERT, the vulnerability results from improper access controls in VBR installations that are integrated with Windows Active Directory. These misconfigurations enable attackers with valid domain credentials to gain unauthorized access and execute commands with elevated privileges. CERT warns that organizations using domain-joined VBR systems — contrary to Veeam’s recommended isolated deployment — are at greater risk of ransomware attacks, data exfiltration, and the complete loss of backup data.

This flaw has raised significant concern due to its low complexity, absence of user interaction, and high potential for abuse by internal or lateral threat actors. Past cybercriminal groups, including Cuba, Akira, Fog, and FIN7, have exploited similar vulnerabilities in backup systems to disable recovery capabilities and spread ransomware across networks. The latest flaw represents a serious threat vector that could allow attackers to take full control of backup infrastructure with minimal resistance.

According to the advisory, the immediate fix is to upgrade to VBR version 12.3.2.3617 or higher. For organizations unable to upgrade immediately, CERT recommends restricting network access to the backup server using firewall rules, implementing multi-factor authentication for all Veeam admin accounts, and reviewing domain account permissions. Additional safeguards include relocating VBR installations to workgroup environments and enforcing role-based access control.

Security analysts caution that successful exploitation could result in remote code execution, privilege escalation, backup deletion, and lateral movement of ransomware within the network. Incident response plans should be updated to include Veeam-related breach scenarios, and organizations are advised to conduct tabletop exercises simulating domain compromise of backup systems. Secure offline backups must be maintained to ensure recovery options remain viable in case of an attack.

Monitoring for this threat involves checking Veeam and Windows Event logs for unusual access attempts, especially from low-privileged domain accounts. CERT further recommends integrating detection mechanisms such as SIEM and endpoint detection and response (EDR) tools to identify and contain any exploitation attempts. Immediate patching remains the most reliable mitigation to prevent system compromise.