Veeam Knowledgebase article

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

Oops! Something went wrong. Please, try again later.

Oops! Something went wrong.

Please, try again later.

Indicated severity values are CVSS 4.0 scores.

CVE-2026-58069 | Severity: High (8.3) A vulnerability allowing an authenticated Veeam Cloud Connect tenant to read arbitrary files on the service provider host.

CVE-2025-64392 | Severity: Medium (4.8) A reflected cross-site scripting vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of an authenticated portal user who opens a crafted link.

CVE-2025-64393 | Severity: Critical (9.4) A vulnerability allowing a low-privileged user with the Backup Viewer role to perform remote code execution (RCE) on the Veeam Backup Server through insecure deserialization of untrusted data received via the Mount Service.

CVE-2026-93026 | Severity: Medium (6.1) A vulnerability allowing an authenticated user with the Backup Viewer role to modify or delete the Enterprise Manager master key and read or overwrite stored antivirus update credentials on the Veeam Backup Server.

After a Linux server is removed from the backup infrastructure, adding the same server again fails with the error: SSH credentials for host ' ' not found

Installation or upgrade of Veeam Agent for Microsoft Windows on Windows 7 and Windows Server 2008 R2 fails with the error: Current operating system is not supported or lacks the required service pack. See system requirements for more information.

Indicated severity values are CVSS 4.0 scores.

CVE-2026-44963 | Severity: Critical (9.4) A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

The Export-VBRAudit cmdlet fails to export audit records for dates after December 31, 2025, and returns the following error: Cannot validate argument on parameter 'From'. Specify DateTime prior to 31-12-2025 00:00:00

Veeam Agent for Linux 6.3.2.1405 Added support for RHEL 10.2 and 9.8. (Support for these versions previously required a kernel module patch .)

Added support for RHEL 10.2 and 9.8. (Support for these versions previously required a kernel module patch .)

Indicated severity values are CVSS 3.1 scores.

CVE-2026-21666 | Severity: Critical (9.9) A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

CVE-2026-21667 | Severity: Critical (9.9) A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

CVE-2026-21668 | Severity: High (8.8) A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.

CVE-2026-21672 | Severity: High (8.8) A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.

CVE-2026-21708 | Severity: Critical (9.9) A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

Decode-uri-component upgraded to version 0.2.2

Newtonsoft.Json upgraded to version 13.0.3

Path-to-RegExp upgraded to version 1.9.0

When updating RHEL infrastructure servers with the DISA STIG profile enabled, the public GPG key used to validate Veeam packages will be updated as well. To ensure a smooth update for these systems, it's recommended to temporarily disable the fapolicyd service (if it's in use) during the update.

PostgreSQL item restore initiated from Enterprise Manager fails due to a deserialization error.

Restoring a Windows-based machine to Microsoft Azure may result in a non-bootable VM. The restore session log contains the following warning: vdmount::CVhdMounter::Mount: step = 5, error = 1392: 00000570

Other OS file-level restore (FLR) mounts may take an excessive amount of time when many preferred networks are configured. To work around this issue, configure the preferred IP address used by the mount server to connect to the backup repository by creating the following registry value on the backup server: Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\ Value Name: FlrMountPreferredIp Value Type: String Value (REG_SZ) Value Data:

Added the GatewaySelectionSkipSameSubnet configuration key to allow skipping gateway selection based on the same subnet, enabling the use of all available gateways in certain environments.

The Move operation can fail for encrypted backups on an HPE StoreOnce repository when moving backups locally to another job using the same repository.

The repository rescan operation can hang when source and target repositories of a backup copy job for HPE StoreOnce repositories containing backup files with identical names are scanned simultaneously.

Restores from legacy tape backups using wide KAD fail due to hardware decryption failures.

Unstructured data backup‑to‑tape jobs hang due to incorrect resource scheduling, blocking incremental tasks.

Jaguar tape drives report incorrect capacity.

The RMAN plug-in manager does not retry connections to VBR if the network connection is interrupted during the execution of the sbtInfo call.

CPU usage when the RMAN plug-in manager is in an idle state may reach up to 25% on the Solaris platform.

Application plug-in installation may fail with a "no digest" error when using the .rpm package.

Veeam Agent for Microsoft Windows 6.3.3.38 Standalone jobs targeting Veeam Backup & Replication v13 fail after editing job settings with a duplicate policy object error.

Standalone jobs targeting Veeam Backup & Replication v13 fail after editing job settings with a duplicate policy object error.

Veeam Agent for Linux 6.3.2.1307 Added support for new Linux distributions in ValPackageIndex.xml, including Debian 13 x64, SLES 15 SP7 (x64, ppc64le), SLES 16 (x64, ppc64le), and OpenSUSE Leap 16.0 x64.

Added support for new Linux distributions in ValPackageIndex.xml, including Debian 13 x64, SLES 15 SP7 (x64, ppc64le), SLES 16 (x64, ppc64le), and OpenSUSE Leap 16.0 x64.

Veeam Agent for Mac 2.3.2.1302 Attempts to mount SMB repositories on macOS 26 failed due to excessive symbolic link levels.

Attempts to mount SMB repositories on macOS 26 failed due to excessive symbolic link levels.

Indicated severity values are CVSS 3.1 scores.

Veeam Backup & Replication Note: The Veeam Software Appliance and upcoming Veeam Backup & Replication v13 software for Microsoft Windows are architecturally not impacted by these types of vulnerabilities.

CVE-2025-48983 | Severity: Critical (9.9) A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user. Note: This vulnerability only impacts domain-joined backup infrastructure servers added to Veeam Backup & Replication v12. Backup infrastructure servers that are not domain-joined are not impacted by this vulnerability. Veeam Backup & Replication Security Best Practice Guide > Workgroup or Domain?

CVE-2025-48984 | Severity: Critical (9.9) A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. Note: This vulnerability only impacts domain-joined Veeam Backup & Replication v12 backup servers. Backup servers that are not domain-joined are not impacted by this vulnerability. Veeam Backup & Replication Security Best Practice Guide > Workgroup or Domain?

Veeam Agent for Microsoft Windows

CVE-2025-48982 | Severity: High (7.3) This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file. More information: Veeam Agent for Microsoft Windows 6.3.2.1302 Private Fix Deployment Information

Indicated severity values are CVSS 3.1 scores.

Veeam Backup & Replication

CVE-2025-23121 | Severity: Critical (9.9) A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. Note: This vulnerability only impacts domain-joined backup servers. Veeam Backup & Replication Security Best Practice Guide > Workgroup or Domain?

CVE-2025-24286 | Severity: High (7.2) A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.

Veeam Agent for Microsoft Windows

CVE-2025-24287 | Severity: Medium (6.1) A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with elevated permissions.

New features and enhancements

NSX-T 4.2.2.1 is now fully supported.

Marking malware events as clean fails with a conversion error when the Microsoft SQL Server hosting the configuration database uses the German (DE) locale.

In rare circumstances, application-aware image processing may hang during the guest components installation.

Preferred CDP proxy selection in the CDP policy wizard is not respected.

CDP replica VMs may hang during the commit failback operation.

A specific sequence of events may result in the NAS backup getting in a state where the retention policy may no longer be applied, with the “Removing non-empty container” operation failing.

NAS backup jobs pointed to an HPE StoreOnce repository may occasionally experience execution delays up to 4 hours.

Veeam Explorer for Active Directory: connection to a target domain controller cannot be established if it has SSL enabled.

Veeam Explorer for Microsoft SQL Server: point-in-time recovery of CDC tables to another SQL server is not possible; Veeam Explorer should now use a mount host automatically when the staging server is unavailable.

Veeam Explorer for Oracle: in certain circumstances, the original database files may be removed when restoring to the original location with a different SID and database name.

Veeam Explorer for PostgreSQL: restoring instances to the latest state and the original location may occasionally fail; the instance restore process fails due to the inability to overwrite a data directory that contains mount points.

Retrieving a certificate revocation list (CRL) may fail due to some firewalls blocking non-RFC-compliant GET requests, resulting in the following error: Certificate revocation check failed Server error 503: Service Unavailable Failed to download CRL

Background checkpoint removal process may lag behind the addition of new data due to poor deletion API call performance on certain on-prem object storage devices, causing continuous backup accumulation. To work around this issue, these API calls will now be called concurrently instead of sequentially.

Restores from hardware-encrypted tapes fail with the following error: Illegal Request. Invalid field in parameter list.

Slow and unresponsive user interface when browsing media pools with a large amount of tape media, and when thousands of media pools are present.

File-to-Tape jobs may fail to process shares containing large files with the following error: Failed to Unload a Scenario. Old Scenario: ScenarioType: ENasToTape (23).

Backup to Tape fails to process NetApp NFS3 occasionally due to a race condition in the caching mechanism, with the following error: Unable to find ObjectVersion in cache for the file.

Addressed compatibility issues with the latest Linux kernel versions, enabling out-of-the-box support for the following distributions: Debian 12.10 and 12.11 Ubuntu 25.04 Red Hat Enterprise Linux (RHEL) 9.6 and 10.0 (both on x86 and IBM Power) Oracle Linux 9.6 Rocky Linux 9.6 and 10.0 AlmaLinux 9.6 and 10.0

Debian 12.10 and 12.11

Red Hat Enterprise Linux (RHEL) 9.6 and 10.0 (both on x86 and IBM Power)

Rocky Linux 9.6 and 10.0

AlmaLinux 9.6 and 10.0

Indicated severity values are CVSS 3.1 scores.

Veeam Backup & Replication

CVE-2025-23120 | Severity: Critical (9.9) A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. Note: This vulnerability only impacts domain-joined backup servers. Veeam Backup & Replication Security Best Practice Guide > Workgroup or Domain?

New features and enhancements

VMware vSphere 9.0 readiness based on the pre-release builds. The official support will be confirmed with a full regression testing of the GA build when it becomes available. This article and KB2443 will be updated with a support statement following that. Update: vSphere 9 is officially supported by this and later Veeam Backup & Replication 12 builds, with a single limitation that 4K native (4Kn) disks are not supported.

NSX-T 4.2.1 is now fully supported.

IBM Db2 plug-in now supports Db2 version 12.1 and SLES 12 SP5.

SAP HANA plug-in now supports SAP HANA 2.0 SPS 08 and SLES 15 SP6 for SAP HANA on IBM Power.

Protection of conditional access policies has been backported from the major release, where it will become available as an option in the user interface. For more information on how to enable this functionality, review this section of the User Guide . Note: This functionality is only available for Essentials, Advanced, and Premium editions.

License consumption logic was updated to no longer consume licenses for external (guest) users and disabled users. Any licenses associated with previously licensed objects will be released automatically 30 days after installing 12.3.1. Alternatively, you can revoke these licenses immediately using the License Information dialog.

Removed the experimental support designation for malware detection, guest file indexing, and application-aware processing, except database log file shipping, which will still be considered experimental. Note: The experimental status removal does not retroactively apply to existing 12.3.0 installs and requires updating to 12.3.1 due to the included related bugfix.

Updated ProxmoxVE plug-in enables the usage of non-root users to register Proxmox, support for Open vSwitch (OVS) networking, Object Storage API (SOSAPI), Nested Pools for backup jobs scope, and brings further backup performance improvements. For more information, please refer to KB4721 .

Instant VM Recovery engine improvements deliver a 5x increased number of simultaneous instant VM recoveries: up to 1000 VMs per backup server and up to 200 VMs per vPowerNFS server. The readiness check for VM migration to production storage has also been optimized to improve performance.

Automatically disconnect vPower NFS datastores after Instant VM Recovery sessions are completed, reduce alarms or misleading capacity planning calculations caused by disconnected vPower NFS datastores. To configure, create the following registry value on the backup server: Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\ Value Name: vPowerNFSUnmountDatastore Value Type: DWORD (32-bit) Value Value Data: 1

Custom Internet proxy support has been added for downloading updates to the Veeam Threat Hunter threat signatures. To configure, create the following registry value on the Mount Server: Key Location: HKLM\ SOFTWARE\Veeam\Veeam Threat Hunter\ Value Name: VTHInternetProxy Value Type: String Value (REG_SZ) Value Data: : Note: The system-wide Internet proxy settings are now also respected; see the Resolved Issues section below.

Automatic bucket creation mode is now used by default for newly created S3-compatible object storage repositories.

Improved object storage compatibility by allowing the backup server to ignore errors caused by S3-compatible object storage using unconventional storage class names. This can be enabled by creating the following registry value on the Veeam Backup Server: Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\ Value Name: S3IgnoreCustomStorageClasses Value Type: DWORD (32-bit) Value Value Data: 1

Dell Data Domain DD OS versions 8.2 and 8.3 support added for Data Domain integration as a backup repository.

Microsoft SQL Server plug-in performance improvements when writing to deduplication appliances, thanks to leveraging parallel streams, each using its own VAB file, even when backing up a single database.

Metadata captured by the Amazon S3 Metadata service is now included in object storage backups to ensure comprehensive bucket data protection.

TLS connection support for the PostgreSQL configuration database has been added for improved security when hosting the database on an external server.

OAuth 2.0 support for nonstandard Azure regions , including the U.S. Government, China, and Germany, is now available for email notifications. To enable this, create the following registry value on the Veeam Backup Server: Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\ Value Name: EmailNotificationMicrosoftCloudInstance Value Type: String Value (REG_SZ) Value Data:

New ISO-based update distribution reduces downtime by accelerating update installation and eliminates the additional disk space requirement on the backup server, which was previously needed for unpacking the update before its installation.

Windows Script Host no longer needs to be temporarily enabled to install product updates.

Added automatic upgrade of Veeam Vault V1 backup repositories (shared keys authentication) to V2 (Entra ID authentication) for added security and improved user experience.

New REST API capabilities include changing existing password records, rescanning all backup repository types, downloading metadata for Unstructured Data backups, and performing backup deletion.

New PowerShell capabilities include connection to Veeam Vaults, querying, and restoring protected Microsoft Entra ID conditional access policies.

The install and update ISOs available for 12.3.1 were updated on 2025-03-31 to include a hotfix that resolves the following critical issues:

Microsoft's deprecation of Basic SKU Public IP Addresses prevents the creation of Azure appliances.

SQL restore points do not appear if Veeam Explorer for Microsoft SQL is launched via the ribbon after the upgrade to v12.3.1.

Archival Jobs logs have numerous 'SourceStorageKeysPreparer' entries, and the job throws the error: Array dimensions exceeded supported range

When deleting backups from disk, the backup console should no longer require a decryption password to be provided for encrypted backups.

Backups in legacy per-VM backup file format should no longer disappear from the Backups > Disk node, preventing you from initiating backup metadata format upgrade.

OS type of VMs restored from backups of other hypervisors is erroneously set as Other.

Backups of powered-off VMs with PCIe passthrough devices fail due to an attempt to back up those devices.

Backup of VMs that are linked clones is not supported and will now correctly fail instead of processing only the base disk without capturing delta.

The job scheduler should no longer suspend the initiation of scheduled backup jobs in certain circumstances.

Scheduled or manual active full protection domain backup jobs should no longer create incremental rather than full VM restore points.

Prism Central category-based exclusions can now be set for jobs using cluster as a backup scope.

Nutanix Guest Tools quiescence advanced job settings are not properly communicated to Nutanix clusters during backup jobs.

In rare circumstances, retention policy processing may delete some restore points preemptively.

Backup agents fail to perform retention processing for backups located on SOBR Capacity Tier extents after the backup chain has been evacuated from a Performance Tier extents running in a direct connection mode.

Veeam Agent for Windows Recovery Media created from Microsoft Windows Server 2025 or Microsoft Windows 11 24H2 machines in certain configuration states, fails to boot.

Veeam Threat Hunter signature update process ignores the system-wide Internet proxy settings and may experience intermittent interruptions due to not retrying unexpected HTTP errors.

Indicators of compromise detection remains enabled even if the parent File system activity analysis checkbox is cleared.

Entire VM restore from scale-out repository Archive Tier may fail for encrypted backups with the error: Master key not found for keyset

Restoring from a backup that has been retrieved from the scale-out repository Archive Tier may fail with the error: Agent failed to process method {DataTransfer.RestoreText}

Reverting Archive Tier to checkpoints using the corresponding PowerShell cmdlet is not possible after a scale-out repository has been recreated.

In certain circumstances, if the initial archiving session fails, all subsequent archiving sessions will fail with the error: Index in DB is not synchronized with archive

Continuously interrupting Capacity Tier offload sessions may result in checkpoints being deleted before the corresponding restore point can be stored, resulting in all subsequent offload sessions failing with the error: Index is not synchronized

Importing encrypted backup containing duplicate encryption keys from Capacity Tier fails with the error: Failed to import backup: Violation of unique key constraint

Backup to Tape jobs will be interrupted by source File Backup job even when the “Prevent this job from being interrupted by source backup jobs” option is selected.

Backup to Tape jobs may experience performance degradation when processing backups produced by File Backup jobs.

The latest firmware updates for some hardware encryption modules cause recovery failures due to the presence of unrecognizable KAD (Key-Associated Data) descriptors.

Configuration database records are not removed after a tape media is erased, causing unnecessary database size growth.

Switch-VBRCloudTenantsQuotaRepositoryToSOBR cmdlet fails to execute for tenants with multiple quotas assigned.

This patch, available as an ISO or EXE , is intended ONLY for patching existing deployments of Veeam Backup & Replication 12.3.2 (build 12.3.2.3617, 12.3.2.4165, 12.3.2.4465, or 12.3.2.4854) . All versions, including 12.3.0 and 12.3.1, must use the full ISO in the section to upgrade.

Note: Both the ISO and EXE contain the same patch. The EXE is smaller because it's a self-extracting archive and installer, but it requires more disk space and takes longer to start installing because it first extracts the patch files. The ISO file is larger, but it can be mounted easily, allowing the patch installation to begin right away since all files are already inside the ISO and don't need to be extracted to a temporary folder.

Update and patch deployment information: Veeam Backup & Replication User Guide: Updating Veeam Backup & Replication

Veeam Recovery Orchestrator 7.2.1 utilizes an embedded deployment of Veeam Backup & Replication 12.3.2.

Customers are encouraged to update the embedded Veeam Backup & Replication deployment using the patch available in this article.

The latest release of Veeam Recovery Orchestrator (also known as Veeam Data Platform Premium ) will deploy an embedded Veeam Backup & Replication already patched to the latest update. However, to update existing deployments, customers should use the Veeam Backup & Replication patch EXE or ISO included in this article .

Filename: VeeamBackup&Replication_12.3.2.4934_20260918_patch.iso SHA256: 022AA099FC01436ECE8B20203B915391E34F07AF185A3224D7FAE4953B458A5B

After downloading the ISO, open the file's properties, select the Unblock option, and click OK. Alternatively, unblock the file using this command:

Failure to unblock the ISO may cause the patch installation to fail with the error:

Filename: VeeamBackup&Replication_12.3.2.4934_20260918_patch.exe SHA256: A4EA29B4E71F06DC7A55529AE30F4608672ACD3C6D01DE1E4EBC4C8F463490DA

Upgrading to 12.3.2.4934 From a Version

Note: Existing Veeam Backup & Replication deployments running 12.3.2.3617, 12.3.2.4165, 12.3.2.4465, or 12.3.2.4854 can use the smaller patch file above to update.

Use the following ISO for:

New deployments of Veeam Backup & Replication 12.3.2.4934.

Upgrading existing deployments of Veeam Backup & Replication (11a, 12, 12.1, 12.2, 12.3.0, or 12.3.1) to 12.3.2.4934.

Remember to always review the Upgrade Checklist as part of your upgrade process.

See the Versions Download Page for ISO hashes.

Please note that a reboot may be required after installing the update.

Please plan accordingly.

Integrated hotfix from KB4727 . Review the updated resolved issues list above for more details.

AWS Plug-In for Veeam Backup & Replication package updated.

Microsoft Azure Plug-in for Veeam Backup & Replication package updated.

Updater ISO Release History

Integrated hotfix from KB4727 . Review the updated resolved issues list above for more details.

AWS Plug-In for Veeam Backup & Replication package updated.

Microsoft Azure Plug-in for Veeam Backup & Replication package updated.

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less .

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case

Your feedback has been received and will be reviewed.

Oops! Something went wrong. Please, try again later.

Oops! Something went wrong.

Please, try again later.