CVE-2025-64393

Executive Summary

CVE-2025-64393 is a deserialization-of-untrusted-data vulnerability (CWE-502) in Veeam Backup & Replication that allows an account holding the Backup Viewer role to execute arbitrary code with SYSTEM privileges on the backup server. Because Backup Viewer is intended to be a low-privilege, read-oriented role, any environment where such accounts exist — or where role assignment is loosely governed — is exposed to full server compromise. The result is a privilege-escalation path from a nominally restricted console user to complete control of a system that typically holds credentials, encryption keys, and access to every protected workload.

Technical Analysis

The vulnerability class is CWE-502, Deserialization of Untrusted Data. In this class, an application accepts a serialized object from a source it should not trust, reconstructs that object in memory, and — depending on the serialization framework — may execute attacker-controlled code during reconstruction (so-called "gadget chains") or may instantiate unintended types that grant the attacker capabilities beyond the intended data flow. The NVD description states the outcome plainly: a Backup Viewer can execute arbitrary code as SYSTEM on the backup server.

Two facts are material. First, the affected product is Veeam Backup & Replication, a backup and disaster-recovery platform that by design runs with very high privilege: the backup server orchestrates jobs across hypervisors, proxies, and repositories, and it stores or brokers credentials for the systems it protects. Second, the actor is a Backup Viewer — a role that is not intended to perform administrative changes. That role-to-impact mismatch is what makes this a privilege-escalation issue rather than a purely remote unauthenticated flaw.

The exact serialized format, the deserialization sink, the message or API surface that carries the serialized payload, and the presence or absence of type allow-listing are not disclosed in the intelligence provided. This report therefore describes the mechanism at the class level and does not assert specific endpoints, method names, or gadget chains. What can be stated with confidence from the description is the trust-boundary violation: data that should have been constrained or validated is instead deserialized in a context whose results are executed as SYSTEM.

Relevant structural considerations for this product family: Veeam Backup & Replication exposes both a management console and service interfaces used by distributed components. Any interface that a Backup Viewer can reach and that internally deserializes structured messages is a candidate attack surface. Because the process that performs the deserialization determines the final privilege of executed code, and because the described impact is SYSTEM, the sink is presumed to sit inside an elevated service context on the backup server itself.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE as of this report; the attack chain below is inferred from the vulnerability class and the NVD description. No specific function names, endpoints, or file paths are asserted, because none are provided.

1. Reconnaissance and target identification. The attacker first needs a foothold with the Backup Viewer role. In practice this is obtained through valid-but-low-privileged credentials (a delegated viewer account, a shared service account, or credentials recovered from elsewhere in the estate), or through any other means that yields authenticated console access. Publicly reachable management interfaces can be discovered via internet-exposed service fingerprinting; internal attackers simply need the account. The attacker then confirms the target is a Veeam Backup & Replication server and enumerates the privileges associated with the viewer role.

2. Triggering the flaw class. With viewer-level access, the attacker locates an input surface that the application deserializes. Per CWE-502, the attacker supplies a crafted serialized payload through that surface. Because the flaw is untrusted deserialization, the application reconstructs the attacker's object graph without adequate validation. No exploitation occurs at the network periphery in the classic unauthenticated sense; the precondition is the viewer session or the ability to submit data on a channel the viewer can reach.

3. Payload and execution. Execution arises from the deserialization process itself: the reconstructed object graph drives code paths that the application did not intend to expose to this role, and the resulting execution inherits the privileges of the process performing the deserialization — SYSTEM on the backup server, per the NVD description. At the class level, this is the standard "deserialization leads to code execution" outcome; the specific gadget chain is not publicly documented.

4. Post-exploitation impact. SYSTEM on a backup server is a high-value position. From there an attacker can read backup catalogs and configuration, access or decrypt backup data, reach stored credentials and encryption material, and pivot into the environments the server protects. The blast radius extends well beyond the backup server itself, which is why the described scope is best modeled as changed (S:C). Although the data set does not attribute this CVE to a known campaign, backup infrastructure is a recurring ransomware target, and a SYSTEM-level primitive on that tier is consistent with pre-encryption credential theft and destruction of recovery capability.

Impact Assessment

Confidentiality, integrity, and availability are all assessed as High. Code execution as SYSTEM on a backup server gives unrestricted read and write access to the host, its configuration, and the data it manages; it also enables tampering with or deletion of recovery points, which directly threatens an organization's ability to restore after a destructive event.

Privileges Required is assessed as Low because the attacker must hold a Backup Viewer account, and no user interaction is required. Attack Vector is Network, reflecting that the deserialization surface is reachable through the product's service/console interfaces rather than requiring local access. Complexity is assessed as Low in the absence of any stated race condition or environmental precondition beyond the viewer role. The Scope assessment (Changed) reflects the well-established reality that compromise of backup infrastructure grants influence over the separate systems and identities it protects.

No official CVSS score or vector was published in the provided data, so the vector above is an analyst assessment and should be treated as such; only the NVD description and CWE-502 are authoritative inputs. Business impact is severe: backup infrastructure is a control point for enterprise recovery, and a viewer-to-SYSTEM escalation undermines the role model that organizations rely on to grant read-only visibility without granting control.

Detection Guidance

Sigma Rule

title: Veeam Backup Viewer Deserialization to SYSTEM (CVE-2025-64393)
id: 7e9c1d2a-4b6f-4c8e-9a1b-0d3f5c7e2b41
status: experimental
description: Detects anomalous child processes spawned by Veeam backup services, consistent with deserialization code execution as SYSTEM.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-64393
author: valtersit.com
date: 2025-01-01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\VeeamBackupSvc.exe'
      - '\Veeam.Backup.Service.exe'
      - '\VeeamDeploymentSvc.exe'
  selection_suspicious_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_suspicious_child
falsepositives:
  - Legitimate administrative scripts executed by Veeam maintenance tasks
level: high
tags:
  - attack.t1190
  - attack.execution
  - cve.2025-64393

YARA Rule

rule CVE_2025_64393_Veeam_Deserialization_Payload
{
    meta:
        description = "Heuristic detection for serialized payload markers relevant to CWE-502 abuses against Veeam Backup & Replication (CVE-2025-64393)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-64393"
        author = "valtersit.com"
        date = "2025-01-01"
        severity = "high"

    strings:
        $bson_marker = { 05 00 00 00 }
        $net_fmt_a = ".NET" ascii wide
        $binary_formatter = "BinaryFormatter" ascii wide
        $type_assembly = "System.Private.CoreLib" ascii wide
        $object_state = "__type" ascii wide
        $veeam_ref = "Veeam" ascii wide

    condition:
        (uint16(0) == 0x0A0D or uint32(0) == 0x464C457F or true) and
        (
            ($binary_formatter and $type_assembly) or
            ($object_state and $veeam_ref and any of ($net_fmt_a))
        )
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2025-64393 Veeam Backup Viewer deserialization payload (CWE-502)"; flow:to_server,established; content:"|05 00 00 00|"; depth:4; content:"Veeam"; nocase; content:"__type"; nocase; distance:0; within:4096; classtype:attempted-admin; reference:cve,2025-64393; reference:url,nvd.nist.gov/vuln/detail/CVE-2025-64393; metadata:created_at 2025_01_01, updated_at 2025_01_01; sid:202564393; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("VeeamBackupSvc.exe", "Veeam.Backup.Service.exe", "VeeamDeploymentSvc.exe") and
  process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")

Splunk SPL Query

index=windows (source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="WinEventLog:Security") EventCode=1
| search ParentImage IN ("*\\VeeamBackupSvc.exe","*\\Veeam.Backup.Service.exe","*\\VeeamDeploymentSvc.exe")
| search Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\rundll32.exe","*\\regsvr32.exe")
| table _time, ComputerName, User, ParentImage, ParentCommandLine, Image, CommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="windows,veeam,cve-2025-64393,">
  <rule id="100593" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">VeeamBackupSvc.exe|Veeam.Backup.Service.exe|VeeamDeploymentSvc.exe</field>
    <field name="win.eventdata.image">cmd.exe|powershell.exe|pwsh.exe|wscript.exe|cscript.exe|mshta.exe|rundll32.exe|regsvr32.exe</field>
    <description>CVE-2025-64393: suspicious child process spawned by Veeam backup service, possible deserialization code execution as SYSTEM</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>veeam,privilege_escalation,cve_2025_64393,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

Immediate mitigations:

1. Treat the Backup Viewer role as an administrative-tier privilege until a fix is available. Audit every account holding it, remove it wherever read access is not strictly required, and enforce MFA and unique credentials for the remainder.
2. Restrict network reachability of the Veeam Backup & Replication management and service interfaces to dedicated administrative networks; do not expose them to untrusted segments or the internet.
3. Monitor for the process-spawning patterns in the detection rules above and alert on any child process originating from Veeam services.
4. Review role-assignment governance and provisioning workflows so that viewer rights are not granted by default or inherited from broad groups.

Patch and upgrade steps:

1. Monitor the vendor's advisory channel and NVD for an official fixed release for CVE-2025-64393. No patch reference is available from tracked sources at this time, so no specific version can be recommended.
2. When a fix is published, validate it in a staging environment, then upgrade the backup server and any distributed components in the documented order.
3. Rotate credentials and encryption material held or brokered by the backup server after remediation, on the assumption that a SYSTEM-level compromise may have exposed them.

Long-term hardening:

1. Apply least privilege to all backup-platform roles and separate read-only visibility from any capability that touches deserialization or execution paths.
2. Segment backup infrastructure from general-purpose networks and require privileged access workstations for console use.
3. Maintain immutable or offline copies of recovery data so that a compromise of the backup server does not translate into loss of restore capability.
4. Extend detection coverage to baseline expected child processes for backup services, so deviations are treated as high-signal events.

References

• NVD — CVE-2025-64393: https://nvd.nist.gov/vuln/detail/CVE-2025-64393
• CWE-502, Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
• Veeam security advisories (vendor advisory channel — monitor for the CVE-2025-64393 fix): https://www.veeam.com/security-advisories.html
• MITRE ATT&CK T1190, Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities catalog (CVE-2025-64393 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept or exploit code has been observed for this CVE, and no threat actor campaign or in-the-wild exploitation has been attributed in the provided intelligence.