Veeam Backup Enterprise Manager XSS allows arbitrary script via crafted link
CVE-2025-64392 Published on October 7, 2026

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.

NVD

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2025-64392 has been classified to as a XSS vulnerability or weakness.


Affected Versions

Veeam Backup Enterprise Manager: