Patch Veeam Backup and replication 12.3.2.3617 to 12.3.2.4165

In this article, we shall discuss how to patch Veeam Backup and replication 12.3.2.3617 to 12.3.2.4165. Veeam has released a critical security update addressing multiple vulnerabilities in Veeam Backup & Replication and Veeam Agent for Microsoft Windows. This indicates the importance of immediate patching to safeguard enterprise backup infrastructures. Please, see see how to upgrade Veeam Backup and Replication 12.3, and Upgrade Veeam Backup and Replication to version 12.2.

The update included in Veeam Backup & Replication version 12.3.2.4165, resolves three recently disclosed vulnerabilities tracked as CVE-2025-48982, CVE-2025-48983, and CVE-2025-48984. Two of the vulnerabilities, “CVE-2025-48983 and CVE-2025-48984”, are rated as Critical with a CVSS v3 score of 9.9.

Both enabling remote code execution (RCE) under specific conditions. The first (CVE-2025-48983) affects the Mount service. This could allow an authenticated domain user to execute arbitrary code remotely on backup hosts.

The second (CVE-2025-48984) impacts the backup server directly. This provides attackers a similar avenue for remote code execution. Both vulnerabilities could enable full system compromise if exploited in an unpatched environment.

The third vulnerability “CVE-2025-48982” is rated High with a CVSS v3 score of 7.3. This affects Veeam Agent for Microsoft Windows. It allows local privilege escalation when an administrator restores a malicious file crafted to exploit elevated permissions.

While exploitation requires local access and administrative interaction. The risk remains significant, especially in environments with limited endpoint protection or where agents perform automated restores

Also, see how to Upgrade Veeam Backup and Replication v12.3.x to 12.3.2, how to update Veeam Backup and Replication [VBR], and how to Fix critical Veeam Backup and Replication 9.5, 10, and 11 vulnerabilities.

Update from Build 12.3.2.3617 to 12.3.2.4165

Veeam confirmed that these vulnerabilities affect only domain-joined servers, while Veeam appliances and the upcoming Veeam Backup & Replication (VBR) version 13 remain unaffected due to architectural improvements. This distinction highlights the company’s ongoing efforts to strengthen isolation and privilege boundaries within its software ecosystem.

First, you have to determine the installed build number. This can be found in the Veeam Backup & Replication Console’s Main Menu (≡) under Help > About as shown below.

As you can see below. We are already running on Build 12.3.2.3617.

This patch is available as an ISO or EXE. The EXE is intended ONLY for patching existing deployments of Veeam Backup & Replication 12.3.2 (build 12.3.2.3617). When you try the ISO in this case, you will be prompted to modify or uninstall your existing installation of Veeam Backup and Replication which is a dangerous thing to do. Also, you can use the ISO for new deployments of Veeam Backup & Replication 12.3.2.4165.

Download Information for Veeam Backup & Replication

Note: For upgrading existing deployments of VBR (11a, 12, 12.1, 12.2, 12.3.0, or 12.3.1) to 12.3.2.4165. You have to use the ISO as shown below.

The update patch can be downloaded here. When you click to download the ISO. Login and enter your password and 2FA code when prompted.

Shortly, the download will be started.

Already on Build 12.3.2.3617? Use the EXE

The executable file is designed exclusively to patch existing installations of Veeam Backup & Replication 12.3.2 (build 12.3.2.3617). Attempting to use the ISO installer instead will trigger a prompt to modify or uninstall the current installation an action that can pose a serious risk to your backup environment.

To download, click on download patch exe as shown below. You will be also redirected to login and the download will start automatically.

Upon download, you have to extract it as shown below. You can also use 7Zip.

Extract to your desired folder

Please, see How to uninstall Veeam Backup and Replication from your server. Also, see how to “Enable Microsoft Defender SmartScreen: How to prevent Exe files from getting deleted randomly in Windows 10 and 11“.

12.3.2.4165 Update Process

Therefore we have to run through this process. Upon extraction, click on the patch as shown below.

On the 12.3.2.4165 patch wizard, click on Next.

Accept the license terms

On the ready to install window. Click on Install

Services are being stoppd

Installation in progress

Cleanup in progress

The services are installing

Installation in progress: Preparing the list of updated files

As you can see, the services are being started again

We have successfully patched our VBR server from build 12.3.2.3617 to 12.3.2.4165. Click on Finish to complete the patch process.

Shortly, you will be required to reboot. When prompted click on Yes. You must have planned and communicated this according before patching the VBR server.

Please, see how to Fix Error 1069: Windows could not start the Veeam backup service on local computer, and how to Update Veeam Backup for Proxmox Plugin to support PVE 9.0

Veeam Component Update

After the main update is installed, Veeam runs a Component Update process to ensure that all associated components across the environment are brought to the same version as the updated backup server.

During this phase, Veeam automatically detects connected components such as backup proxies, repository servers, WAN accelerators, and transport services and updates them to match the newly installed build. This step is crucial to maintain compatibility and ensure proper communication between the backup server and its managed systems.

The Component Update process starts automatically after you launch Veeam Backup & Replication console following the patch installation. You will be prompted to review and confirm which components that need updating.

Once confirmed, Veeam will sequentially update these components, temporarily stopping related services during the process and restarting them once the upgrade is complete. To do this, click on Apply as shown below.

Click on Finish to complete this process. As you can see below. All components have been upgraded with warning.

Since this blogpost was created late at night, there was no time to dig into this. This is not so trivial as it is a warning, and I will you the steps to troubleshoot in another guide. Take a look at some recommendations.

We are currently on the latest build as shown below “12.3.2.4165”.

Do not forget to update your agents as well to Veeam Agent for Windows version 6.3.2.1302. Applying these updates promptly mitigates the risk of exploitation and ensures compliance with current security standards. As a best practice, organizations should also review access controls on their backup infrastructure, limit administrative privileges to essential personnel, and monitor network activity for signs of unauthorized access attempts.

Update VBR Console

When you have the Veeam Backup Console on a Jump Server as discussed here. Note that connecting directly to the backup server has several drawbacks, and it follows the same principle as not connecting to Domain Controllers directly.

Instead of initiating an RDP session to the backup server, administrators can use the Veeam Backup & Replication console on their workstations, much like managing Active Directory with Microsoft RSAT tools. To do this, launch the VBR console and when prompted to update to build 12.3.2.4165, click on Yes.

The update is in progress

VBR console update completed successfully.

FAQs

I hope you found this article useful on how to Patch Veeam Backup and replication 12.3.2.3617 to 12.3.2.4165. Please, feel free to leave a comment below.