CVE-2025-64392: CWE-79 Cross-site Scripting (XSS) - Reflected in Veeam Backup Enterprise Manager

This vulnerability in Veeam Backup Enterprise Manager is a reflected XSS (CWE-79) flaw that enables an attacker to inject and execute malicious scripts in the context of a portal user's browser session. The attack requires the user to open a crafted link, which then reflects the malicious script back to the user's browser. The affected versions are >=12 and <12.3.2.4934. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required but user interaction is needed, and limited scope and impact confined to integrity and availability with low confidentiality impact.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected user's browser session within the Veeam Backup Enterprise Manager portal. This could lead to actions such as session hijacking or unauthorized actions performed on behalf of the user. However, the impact is limited by the requirement for user interaction and the reflected nature of the XSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, users should exercise caution when clicking links related to the Veeam Backup Enterprise Manager portal, especially from untrusted sources.