What’s Vulnerable › Vulnerabilities

CVE-2025-23114

• Severity: critical (CVSS 9.0 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-05 · updated 2026-06-17
• Weakness: CWE-295

Description

A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly validate TLS certificate.

Affected products

• Veeam Backup for Microsoft Azure: from 6.0 through 6.0
• Veeam Backup for AWS: from 7.0 through 7.0
• Veeam Backup for Google Cloud: from 5.0 through 5.0
• Veeam Backup for Nutanix AHV: from 5.1 through 5.1
• Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization: from 4.1 through 4.1
• Veeam Backup for Salesforce: from 3.1 through 3.1

References

• https://www.veeam.com/kb4712

Get alerted when CVE-2025-23114 or the next vulnerability affects your stack