# CVE-2025-64393: Veeam Backup & Replication insecure deserialization in Mount Service

Source: https://junglewise.ai/threats/cve-2025-64393-this-vulnerability-in-veeam-backup-replication-allows-a-backup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2025-64393 · Severity: info · Published 2026-10-07

Veeam Backup & Replication is enterprise backup software that protects critical business data. A low-privileged user with read-only Backup Viewer access can execute arbitrary code with SYSTEM privileges on the backup server, potentially exposing all backed-up data and compromising the infrastructure protecting it.

Technologies: [Veeam Backup & Replication](https://junglewise.ai/threats/technologies/backup-replication). Vendors: [Veeam](https://junglewise.ai/threats/vendors/veeam).

## Quick answers

**Is CVE-2025-64393 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64393 being exploited in the wild.

**How severe is CVE-2025-64393?** Informational severity, published 7 October 2026.

**Which products and versions are affected?** Veeam Backup & Replication version 12 up to 12.3.2.4854.

**Is there a fix for CVE-2025-64393?** Yes: fixed in Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-64393 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-64393?** Check whether you run Veeam Backup & Replication at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934)

## Technical details

The vulnerability is an insecure deserialization flaw in the Mount Service component that processes untrusted data from network requests. A Backup Viewer (read-only) role user can trigger remote code execution without user interaction, gaining complete control of the backup server with SYSTEM privileges.

## Affected products

- Veeam Backup & Replication version 12 up to 12.3.2.4854

## Timeline

- 2026-10-06: disclosed
- 2026-10-06: patched: Fix available in 12.3.2 P4

## References

- [https://www.veeam.com/KB4934](https://www.veeam.com/KB4934)

## Related threats

- [Veeam Backup & Replication authorization bypass in CDP Coordinator](https://junglewise.ai/threats/cve-2026-108142-a-vulnerability-allowing-an-unauthenticated-attacker-to-bypass)
- [Veeam Backup & Replication path traversal in restore](https://junglewise.ai/threats/cve-2026-108141-a-vulnerability-allowing-an-authenticated-user-with-the-restore)
- [Veeam Backup & Replication path traversal via restore operator](https://junglewise.ai/threats/cve-2026-108140-a-vulnerability-allowing-an-authenticated-user-with-the-restore)
- [Veeam Backup & Replication privilege escalation in Enterprise Manager](https://junglewise.ai/threats/cve-2026-93026-this-vulnerability-in-veeam-backup-replication-allows-a-backup)
- [Veeam Backup & Replication arbitrary file read in Cloud Connect](https://junglewise.ai/threats/cve-2026-58069-this-vulnerability-in-veeam-backup-replication-allows-an)