CVE-2025-23114
Critical
Description
A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly validate TLS certificate.
SeverityCritical
CVSS9.0
Exploit probability—
Product
Backup for AWS
PublishedFeb 5, 2025
First seenFeb 5, 2025
Weakness typeCWE-295CWE-295
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Veeam Backup for AWS | 7.0 | — |
| Veeam Backup for Microsoft Azure | 6.0 | — |
| Veeam Backup for Google Cloud | 5.0 | — |
| Veeam Backup for Nutanix AHV | 5.1 | — |
| Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization | 4.1 | — |
| Veeam Backup for Salesforce | 3.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.