CVE-2025-64393 Critical · 9.4 EPSS 5.2%
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
Veeam · Backup and Replication
Summary
This is a flaw in the Backup Viewer role of Veeam Backup & Replication, where untrusted data is deserialized. An attacker holding a low-privileged Backup Viewer account on the network can execute arbitrary code as SYSTEM on the backup server, with no user interaction required.
Heading is the official description · NVD
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
27.3 / 100
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 7 Oct 2026. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 9 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Known_Cve | Oct 16, 2026 | Part 1/315 Oct 2026
- Known_Cve | Oct 15, 2026 | Part 1/314 Oct 2026
- Known_Cve | Oct 14, 2026 | Part 1/313 Oct 2026
- Known_Cve | Oct 13, 2026 | Part 1/212 Oct 2026
- Known_Cve | Oct 12, 2026 | Part 1/211 Oct 2026
- Known_Cve | Oct 11, 2026 | Part 2/210 Oct 2026
- 3 more on OTX