Veeam and BeyondTrust on Tuesday announced patches for multiple vulnerabilities that could be exploited to execute arbitrary code.
BeyondTrust released fixes for a high-severity security defect in its Remote Support (RS) and Privileged Remote Access (PRA) products, warning that it can lead to remote code execution (RCE) through template injection.
Tracked as CVE-2025-5309 (CVSS score of 8.6), the flaw is described as a server-side template injection issue in the chat feature of RS and PRA.
The bug exists because input intended for the template engine is not properly escaped, and allows attackers to execute code in the context of the server. Attackers can exploit the vulnerability against RS deployments without authentication.
According to BeyondTrust, the flaw impacts RS and PRA versions 24.2.2 to 24.2.4, 24.3.1 to 24.3.3, and 25.1.1. Patches were rolled out for all affected cloud iterations and are available for download for on-premises deployments.
Veeam on Tuesday announced the release of Veeam Backup & Replication 12.3.2 with fixes for two security defects that could lead to code execution.
The first, tracked as CVE-2025-23121 (CVSS score of 9.9), is a critical bug that allows a remote, authenticated domain user to execute arbitrary code on the Backup Server.
The second, tracked as CVE-2025-24286, is a high-severity issue that allows an attacker authenticated as a Backup Operator to tamper with backup jobs, which would lead to code execution.
Additionally, Veeam resolved a medium-severity vulnerability in Veeam Agent for Microsoft Windows that could allow local users with System privileges to modify directory contents and execute arbitrary code.
Neither BeyondTrust nor Veeam mention any of these security defects being exploited in the wild. However, threat actors have been observed exploiting flaws in their products and users are advised to update their installations as soon as possible.
Related: Organizations Warned of Vulnerability Exploited Against Discontinued TP-Link Routers
Related: Asus Armoury Crate Vulnerability Leads to Full System Compromise
Related: Cisco Patches High-Severity DoS, Privilege Escalation Vulnerabilities
Related: GitLab, Atlassian Patch High-Severity Vulnerabilities
