Skip to content
CVE PROGRAM SOURCE RECORD9.0 Critical

CVE-2025-23114

A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly valid

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly validate TLS certificate.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Veeam Backup for AWS

Default version status: unaffected

  • 7.0 to ≤ 7.0affected

Veeam Backup for Microsoft Azure

Default version status: unaffected

  • 6.0 to ≤ 6.0affected

Veeam Backup for Google Cloud

Default version status: unaffected

  • 5.0 to ≤ 5.0affected

Veeam Backup for Nutanix AHV

Default version status: unaffected

  • 5.1 to ≤ 5.1affected

Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization

Default version status: unaffected

  • 4.1 to ≤ 4.1affected

Veeam Backup for Salesforce

Default version status: unaffected

  • 3.1 to ≤ 3.1affected

References