CVE-2025-64393: The Mount Service, the Backup Viewer Role and a 9.4 Score

Overview

CVE-2025-64393, disclosed in Singapore CSA alert AL-2026-138, is a 9.4-rated CVSS v4.0 vulnerability in Veeam Backup & Replication 12 through 12.3.2.4854. The exploitation sequence combines a modest-looking role with a service that deserialises untrusted data. Veeam KB4934 is the vendor advisory, and the CVE record is held in NVD.

Decomposing the score

A high base score usually reflects several contributing factors rather than one dramatic weakness. Here the contributing factors follow directly from the alert's wording. The flaw permits remote code execution, which drives impact upward. The outcome is SYSTEM, so the attacker inherits the highest privilege on the host. The affected component is a backup server, so the consequences extend to the systems that depend on it for recovery.
What keeps the score from being higher is the access condition. The attacker must hold the Backup Viewer role. That is a real barrier, but it is a barrier that depends on how carefully the role was granted, not on the attacker's skill.

The two named components

The Mount Service is the interface implicated in the deserialisation weakness. It is the place where the trust decision failed. The Backup Viewer role is the credential the attacker brings. Read together, the advisory describes a vulnerability whose exploitability is governed by identity configuration as much as by version.

Why this matters for patch planning

Teams with thousands of findings triage by external exposure, and that heuristic is usually reasonable. For CVE-2025-64393 it can be misleading. A backup server with the Mount Service reachable from a broad internal network and Backup Viewer granted liberally is more exposed than its external scan result suggests.

Affected products and scope

Versions 12 through 12.3.2.4854. Confirm the running build against Veeam KB4934, and separately inventory the principals holding Backup Viewer; the two together define your real scope.

Exposure context

A ZoomEye query for title="Veeam Backup" returned 15,647 matching assets. The count describes visible Veeam-branded assets, not affected builds, and the CVE-specific filter returned zero, which is typical soon after publication. Treat the number as context for how common this product family is, not as a measure of this vulnerability.

Remediation and mitigations

Apply the vendor fix, then reduce the identity-side exposure: remove unnecessary Backup Viewer assignments and constrain who can reach the Mount Service. Verify the running build after the change, and record the role decisions alongside the patch record so the two halves of the remediation stay visible together.