Veeam has issued security updates to address several vulnerabilities, including a critical RCE flaw (CVE-2025-23121) affecting domain-joined installations. These vulnerabilities have been exploited by ransomware gangs to deploy malware like Frag, Akira, and Fog, targeting high-profile organizations. #Veeam #CVE-2025-23121
Keypoints
- Veeam released security patches to fix multiple vulnerabilities in Backup & Replication software.
- The critical RCE vulnerability (CVE-2025-23121) impacts domain-joined VBR installations.
- Exploitations of these vulnerabilities have enabled ransomware attacks such as Frag, Akira, and Fog.
- Many organizations improperly join backup servers to domains, increasing risk, despite Veeam’s best practice recommendations.
- Threat actors including Cuba and FIN7 have previously exploited Veeam vulnerabilities for malicious gains.