Critical remote code execution flaw hits Veeam backup servers

Veeam published a critical security update on 6 October 2026 for Veeam Backup & Replication, one of the most widely deployed backup platforms in the enterprise market. The advisory, KB4934, closes three vulnerabilities. The most serious of them, CVE-2025-64393, carries a CVSS 4.0 score of 9.4 out of 10.

According to Veeam, the flaw stems from insecure deserialization of untrusted data received through the Mount Service. The practical result is that an account holding only the Backup Viewer role — normally a read-only, reporting-level permission — can execute code remotely on the backup server. All version 12 builds up to and including 12.3.2.4854 are affected. The fix ships in 12.3.2 P4 (build 12.3.2.4934); version 13 is not affected.

The same patch closes CVE-2026-93026 (CVSS 6.1), also reachable from Backup Viewer accounts, which allows an attacker to alter or delete the Enterprise Manager master key. CVE-2025-64392 (CVSS 4.8) is a reflected cross-site scripting flaw in the Enterprise Manager interface. Veeam reported no in-the-wild exploitation in its advisory, and no public proof-of-concept has been confirmed.

Why the backup server is a prime target

Ransomware crews have followed the same playbook for years: disable the backups before starting the encryption. Once the backup server falls, the attacker removes the victim's ability to recover and simultaneously gains a single point of access to data from every protected system. Veeam deployments have been targeted before — CVE-2024-40711 and CVE-2025-23120 both appeared in real attacks shortly after their patches were released.

What makes this particular flaw awkward is that the attack does not begin with a privileged administrator account. Backup Viewer is a role that many organisations hand out freely to reporting staff, internal audit teams, or external service providers. Where permission inventories are not maintained, nobody is quite sure who still holds it.

What this means for Turkish SMBs

In Turkey, mid-sized companies typically build their virtualisation and backup layer on Veeam running over VMware or Hyper-V. A significant share of those deployments sit on a single server, and version upgrades tend to happen once or twice a year, whenever a maintenance window opens up. In practice that means a large number of businesses are still running 12.3.2.4854 or an older build today.

There is a compliance dimension as well. A breach reached through the backup server can expose personal data held across every system in the organisation, which falls squarely under the data security obligation in Article 12 of Law No. 6698. Notification to the Turkish data protection authority is required within 72 hours of discovery.

What Kamer Bilişim recommends

• Verify your build today and move to 12.3.2.4934. Check the build number under Help > About in the console. If you are on 12.3.2.4854 or earlier, do not defer the upgrade to the next scheduled window — and take a copy of the backup configuration and database before you patch.
• Audit every role, starting with Backup Viewer. Produce a list of who holds which role, and close accounts belonging to departed staff and vendors you no longer work with. Enforce multi-factor authentication on every account that can reach the backup console.
• Isolate the backup server and keep an immutable copy. Restrict console access to specific management IP addresses, keep the server outside the same trust boundary as your domain administrators, and hold at least one backup copy on immutable storage or offline media.

If you are not certain which build your backup infrastructure is running, or you want the upgrade planned without downtime, our team works across the Anatolian side of Istanbul and remotely. Get in touch through our contact page for a review of your Veeam version, role assignments and restore testing.

Source: Veeam KB4934 official security advisory and Singapore Cyber Security Agency (CSA) alert AL-2026-138