Veeam has released a security update for its Backup & Replication software in response to a critical RCE vulnerability caused by a deserialization flaw which can be exploited by any user who belongs to the local users group on the Windows host of the Veeam server, or even any domain user if you have joined your server to the domain. The issue received a critical severity rating of 9.9 out of 10 and could significantly compromise the integrity of your data and operations. You can find more details in our Veeam Vulnerability Blog.
To help you locate any vulnerable Veeam Backup & Replication installations, the report below will provide you with an overview of all affected installs that you still need to update. This way you have an actionable list of installs that need your intervention.
Run the Veeam Backup & Replication (March 2025) Vulnerability Audit Report Now!

Select Top 1000000 tblAssets.AssetID, tblAssets.AssetName, tblAssets.Domain, tblAssets.Username, tblAssets.Userdomain, Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon, tblAssets.IPAddress, tsysIPLocations.IPLocation, tblAssetCustom.Manufacturer, tblAssetCustom.Model, tsysOS.OSname As OS, tblAssets.Version, tblAssets.SP, tblSoftwareUni.softwareName, tblSoftwareUni.SoftwarePublisher, tblSoftware.softwareVersion, Case When Cast(ParseName(tblSoftware.softwareVersion, 4) As int) > 12 Then 'Safe' When Cast(ParseName(tblSoftware.softwareVersion, 4) As int) = 12 And Cast(ParseName(tblSoftware.softwareVersion, 3) As int) > 3 Then 'Safe' When Cast(ParseName(tblSoftware.softwareVersion, 4) As int) = 12 And Cast(ParseName(tblSoftware.softwareVersion, 3) As int) = 3 And Cast(ParseName(tblSoftware.softwareVersion, 2) As int) > 1 Then 'Safe' When Cast(ParseName(tblSoftware.softwareVersion, 4) As int) = 12 And Cast(ParseName(tblSoftware.softwareVersion, 3) As int) = 3 And Cast(ParseName(tblSoftware.softwareVersion, 2) As int) = 1 And Cast(ParseName(tblSoftware.softwareVersion, 1) As int) >= 1139 Then 'Safe' Else 'Vulnerable' End As [Vulnerable/Safe], Case When tblErrors.ErrorText Is Not Null Or tblErrors.ErrorText != '' Then 'Scanning Error: ' + tsysasseterrortypes.ErrorMsg Else '' End As ScanningErrors, tblAssets.Lastseen, tblAssets.Lasttried From tblAssets Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype Inner Join tsysIPLocations On tsysIPLocations.LocationID = tblAssets.LocationID Inner Join tblState On tblState.State = tblAssetCustom.State Inner Join tblSoftware On tblSoftware.AssetID = tblAssets.AssetID Inner Join dbo.tblSoftwareUni On tblSoftware.softID = tblSoftwareUni.SoftID Left Join tsysOS On tsysOS.OScode = tblAssets.OScode Left Join (Select Distinct Top 1000000 tblErrors.AssetID As ID, Max(tblErrors.Teller) As ErrorID From tblErrors Group By tblErrors.AssetID) As ScanningError On tblAssets.AssetID = ScanningError.ID Left Join tblErrors On ScanningError.ErrorID = tblErrors.Teller Left Join tsysasseterrortypes On tsysasseterrortypes.Errortype = tblErrors.ErrorType Where tblSoftwareUni.softwareName Like 'Veeam Backup & Replication%' And tblState.Statename = 'Active' Order By tblAssets.Domain, tblAssets.AssetName
Explore the full platform, free for 14 days.
No credit card required.