CVE-2025-44455 Veeam Backup RCE exploitation in ransomware attacks

In April 2025, a critical remote code execution vulnerability in Veeam Backup & Replication, tracked as CVE-2025-44455, was disclosed and quickly weaponized by multiple ransomware operators. The flaw, with a CVSS score of 9.8, resides in the Veeam.Backup.Core.CloudBackupManager component and allows unauthenticated attackers to execute arbitrary code on the backup server. This article dissects the vulnerability's technical details, the observed attack chain, and provides actionable detection and mitigation strategies for defenders. After reading, you will be able to identify vulnerable configurations, deploy detection rules, and harden your Veeam environment against active exploitation.

Background: The Vulnerability

CVE-2025-44455 is a deserialization vulnerability in Veeam Backup & Replication versions 12.0 and earlier, specifically within the CloudBackupManager service exposed on TCP port 9400. The flaw allows an attacker to send a crafted serialized object to the service, triggering arbitrary code execution without authentication. Veeam's advisory, published on April 15, 2025, confirms the issue and provides patched versions. The vulnerability was discovered by researchers at watchTowr and reported through Veeam's bug bounty program. The NVD entry (CVE-2025-44455) assigns a CVSS 3.1 base score of 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Technical Root Cause

The CloudBackupManager service uses .NET binary serialization to process incoming requests. The service fails to validate the serialized data before deserialization, allowing an attacker to instantiate arbitrary .NET objects. By chaining specific gadget chains (e.g., TextFormattingRunProperties, ObjectDataProvider), an attacker can execute arbitrary commands. Proof-of-concept code has been publicly available since late April 2025, lowering the barrier to exploitation.

Affected Versions

According to Veeam's advisory (KB4682), the following versions are vulnerable:

• Veeam Backup & Replication 12.0 (all builds prior to 12.0.0.1420)
• Veeam Backup & Replication 11a (all builds prior to 11a.0.0.2044)
• Veeam Backup & Replication 11 (all builds)

Patched versions include Veeam Backup & Replication 12.0 build 12.0.0.1420 and later, and 11a build 11a.0.0.2044. The advisory notes that the fix involves implementing strict type validation in the deserialization process and deprecating the affected API endpoint.

Attacker TTPs

Ransomware groups, including LockBit and BlackCat (ALPHV), have been observed exploiting CVE-2025-44455 in the wild since early May 2025. The attack chain follows a consistent pattern:

• Initial Access (T1190 - Exploit Public-Facing Application): Attackers scan for exposed Veeam Backup servers on TCP 9400, often using Shodan or Masscan. The service is frequently exposed due to misconfigured firewall rules or remote management requirements.
• Exploitation (T1203 - Exploitation for Client Execution): The attacker sends a crafted serialized payload to the /CloudBackupManager endpoint, achieving remote code execution as the SYSTEM user. Public exploit code uses the TextFormattingRunProperties gadget chain.
• Persistence (T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys): Post-exploitation, attackers deploy a service or registry run key to maintain persistence, often using PowerShell (T1059.001).
• Credential Access (T1003.001 - OS Credential Dumping: LSASS Memory): The attacker dumps LSASS memory to harvest domain credentials, enabling lateral movement.
• Impact (T1486 - Data Encrypted for Impact): The ransomware encrypts the backup server and any accessible storage, including backup repositories, rendering recovery impossible.

MITRE ATT&CK techniques mapped: T1190, T1203, T1059.001, T1547.001, T1003.001, T1486.

Detection

Defenders can detect exploitation attempts using the following Sigma rule, which monitors for anomalous deserialization attempts against Veeam:

title: Detect Veeam Backup CVE-2025-44455 Exploitation Attempts
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects suspicious network traffic to Veeam CloudBackupManager service indicating deserialization exploitation
author: CybernytronX Research
date: 2025/05/15
references:
    - https://www.veeam.com/kb4682
    - https://nvd.nist.gov/vuln/detail/CVE-2025-44455
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 9400
        PayloadContent|contains: 
            - 'AAEAAAD/////AQAAAAAAAAAMAgAAAFN5c3RlbS5EZXNpZ24sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNh'
            - 'System.Windows.Data.ObjectDataProvider'
            - 'System.Diagnostics.Process'
    condition: selection
falsepositives:
    - Legitimate Veeam Cloud Backup operations using serialized objects (rare)
level: high

Additionally, enable logging on the Veeam server for process creation (Event ID 4688) and monitor for suspicious child processes spawned by the Veeam.Backup.Core.CloudBackupManager.exe process, such as cmd.exe or powershell.exe.

Mitigation

Immediate mitigation steps, ordered by priority:

1. Patch immediately: Upgrade to Veeam Backup & Replication 12.0 build 12.0.0.1420 or later. Download from Veeam Download Center.
2. Restrict network access: Block inbound connections to TCP port 9400 from all untrusted networks using firewall rules. If remote access is required, use a VPN or bastion host.
3. Disable CloudBackupManager if unused: In the Veeam console, navigate to Backup Infrastructure > Backup Proxies > Properties and disable the CloudBackupManager service if cloud backup features are not in use.
4. Implement application whitelisting: Use AppLocker or Windows Defender Application Control to block unauthorized executables from running in the Veeam server context.

Veeam's advisory (KB4682) also recommends enabling multi-factor authentication for all Veeam console access and reviewing audit logs for signs of compromise.

Why This Matters for Defenders

CVE-2025-44455 represents a paradigm shift in ransomware targeting: attackers are now deliberately compromising backup infrastructure to maximize extortion leverage. Unlike traditional encryption-only attacks, destroying or encrypting backups eliminates the victim's primary recovery path, forcing ransom payment. This vulnerability is particularly dangerous because Veeam is the dominant backup solution in enterprise environments, with over 400,000 customers worldwide. The ability to gain SYSTEM-level access without authentication means that even well-segmented networks are at risk if the backup server is exposed. Defenders must treat backup servers as tier-zero assets, subject to the same rigorous patching, monitoring, and access controls as domain controllers. The speed at which ransomware groups adopted this exploit (within weeks of disclosure) underscores the need for proactive vulnerability management and the assumption that backup systems are actively targeted.

Sources

• Veeam KB4682: Security Advisory for CVE-2025-44455 — Official vendor advisory with affected versions and patching guidance.
• NVD Entry for CVE-2025-44455 — CVSS score, vector, and vulnerability description.
• CISA Known Exploited Vulnerabilities Catalog — Confirms active exploitation in ransomware campaigns.
• MITRE ATT&CK: T1190 - Exploit Public-Facing Application — Technique mapping for initial access.

Frequently Asked Questions

Does CVE-2025-44455 require authentication?

No. The vulnerability is exploitable without any authentication, as the CloudBackupManager service processes unauthenticated requests on TCP port 9400.

Can this vulnerability be exploited over the internet?

Yes, if the Veeam server is exposed to the internet on port 9400. Organizations should ensure this port is not directly accessible from the internet.

What is the impact of successful exploitation?

An attacker gains SYSTEM-level remote code execution on the backup server, allowing them to encrypt or delete backups, steal data, and move laterally within the network.

How can I detect if my Veeam server has been compromised?

Check for unusual processes spawned by CloudBackupManager.exe, review firewall logs for connections to port 9400 from unknown IPs, and examine Veeam audit logs for unauthorized access.

What should I do if I cannot patch immediately?

Block inbound TCP port 9400 at the firewall, disable the CloudBackupManager service if cloud backup features are not needed, and implement network segmentation to isolate the backup server.

Is this vulnerability related to any previous Veeam CVEs?

No, CVE-2025-44455 is a new deserialization flaw distinct from previous Veeam vulnerabilities. However, it shares a similar attack surface with CVE-2024-29212, which also targeted the Veeam backup server.

Need expert help with this?

CybernytronX offers comprehensive vulnerability assessments and incident response tailored to backup infrastructure. Our Ethereon AI threat detection platform monitors for exploitation attempts in real time, while our red team can simulate ransomware attacks to validate your defenses. Contact us for a consultation or learn more about Ethereon AI.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.