Veeam Backup and Recovery: remote code execution in domain user handler (CVE-2025-23120) #shorts

Summary

In today's security news, we're addressing a critical vulnerability identified as CVE-2025-23120. This vulnerability affects Veeam Backup and Recovery, a popular software used for data backup and protection. Let's explore what makes this vulnerability problematic and why it demands immediate attention from users.

Product details

The product implicated by CVE-2025-23120 is Veeam Backup and Recovery. This software is widely used for managing backup and replication tasks, ensuring data integrity and availability across multiple platforms and environments. Importantly, the versions affected are 12.0 through 12.3, with the vulnerability particularly impacting systems that are part of a domain network.

Vulnerability type summary

The nature of CVE-2025-23120 is a critical Remote Code Execution (RCE) vulnerability. Such vulnerabilities are highly dangerous as they allow attackers to execute arbitrary commands or code on a target machine without the need for direct physical access.

Details of the vulnerability

CVE-2025-23120 was first published in March 2025. It specifically targets the Domain User Handler component of Veeam Backup and Recovery. This vulnerability arises in domain-joined systems, presenting a significant risk for enterprises using these configurations. The vulnerability allows remote actors to potentially gain control of the affected systems, execute malicious code, and compromise sensitive data.

Conclusion

In conclusion, Veeam has responded to this critical RCE vulnerability by providing necessary patches and urging all users to upgrade to the latest version. It is imperative for anyone using Veeam Backup and Recovery, especially versions 12.0 to 12.3 on domain networks, to apply these security updates immediately to protect their systems from potential exploitation.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://www.veeam.com/kb4724