Collected research

By Executive Order, We Are Banning Blacklists: Domain-Level RCE in Veeam Backup and Replication (CVE-2025-23120)

Piotr Bazydlo and Sina Kheirkhah · watchTowr · 20 March 2025

Traces a Veeam .NET Remoting chain through an allowed outer object and denylisted inner deserialization. Product-specific DataSet subclasses inherit dangerous parent behavior while escaping class-name checks; the source also follows Windows Users membership to explain the conditions under which an ordinary domain account reaches the sink.

Record

Researcher

Piotr Bazydlo and Sina Kheirkhah

Published by

watchTowr

Date

20 March 2025

Topic

Browser

In the archive

• Collected in the 2025 research round

Related sources

• Earlier Veeam deserialization proof of concept

Tags

• dotnet
• deserialization
• gadget-chain
• filter-bypass
• privilege-escalation
• rce
• owasp-a01-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Piotr Bazydlo and Sina Kheirkhah, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.