Veeam Backup Enterprise Manager JobManagmentService Improper Access Control Remote Code Execution Vulnerability
July 21st, 2025
Vulnerability Details
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Veeam Backup Enterprise Manager. Authentication is required to exploit this vulnerability.
The specific flaw exists within the JobManagmentService component. The issue results from improper access control. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
Additional Details
Veeam has issued an update to correct this vulnerability. More details can be found at:
https://www.veeam.com/kb4743
Disclosure Timeline
- 2025-03-10 - Vulnerability reported to vendor
- 2025-07-21 - Coordinated public release of advisory
- 2025-07-21 - Advisory Updated
Credit
Nikolai Skliarenko of Trend Micro Security Research
