NAKIVO Backup CVE-2024-48248: Exploited Pre-Auth File Read

What to do

1. Find every NAKIVO Director, including installs on NAS devices, and record its version from the web interface.
2. Upgrade to the current release, at minimum 11.0.0.88174, and to 11.0.2 or later for CVE-2025-32406.
3. Remove internet exposure of the Director web interface (4443/TCP by default per watchTowr) and allow it only from a management network.
4. If an old build was reachable, rotate every hypervisor, cloud, NAS and physical-machine credential stored in NAKIVO.
5. Check that backups and backup repositories are intact and that an offline or immutable copy exists.

How to check if you are affected or compromised

• Search web and firewall logs for requests to /c/router on the Director from addresses outside your management network.
• Look for logins to vCenter, ESXi, Hyper-V, cloud accounts or NAS devices using NAKIVO's stored service credentials from unexpected sources.
• Review NAKIVO job history for deleted backups, changed retention or new inventory items nobody created.
• Run watchTowr's published detection artifact generator against your own Director to confirm it is no longer vulnerable.

What happened#

NAKIVO Backup & Replication protects VMware, Hyper-V, cloud and physical workloads. watchTowr found that its Director web interface would read and return files from anywhere on disk without a login. watchTowr reported it on September 13, 2024. NAKIVO fixed it in version 11.0.0.88174 on November 4, 2024 without mentioning it in the release notes, according to the watchTowr write-up of February 26, 2025. NAKIVO's advisory, last modified March 6, 2025, says the flaw "could expose sensitive data, including configuration files, backups, and credentials." The release notes now list the fix under v11.0.

The CVE record warns that the bug "may lead to remote code execution across the enterprise" because the product stores credentials for the systems it backs up. watchTowr showed how those stored secrets can be recovered, and notes that the product runs as a superuser. NVD scores it CVSS 3.1 8.6. CISA added it to KEV on March 19, 2025, three weeks after public exploit code appeared.

Who is affected#

NAKIVO lists 10.11.3.86570 and earlier. The CVE record says every version before 11.0.0.88174. That includes the NAS packages. QNAP pulled affected versions from its App Center on March 22, 2025 while it waited for a fixed build. A later bug, XXE CVE-2025-32406, was fixed in 11.0.2. The current release is 11.2.3, dated September 30, 2026.

Do you really need to act?#

If every Director was upgraded in late 2024 or early 2025 and sits on a management network, there is little left to do. Otherwise, take it seriously. A backup server holds the keys to your hypervisors and storage, and attackers who want to stop recovery go after backups first. Help Net Security noted it was unknown whether ransomware crews were using it. SecurityWeek gave no attribution. No public report has named the attackers as of Oct 23, 2026. A file read leaves little trace, so if an old build was reachable, assume its stored credentials are known and rotate them.

What to do now#

1. Find every Director, including NAS installs, and record its version.
2. Upgrade to the current release, at least 11.0.2.
3. Keep the Director interface off the internet. watchTowr notes it listens on 4443/TCP.
4. Where an old build was exposed, rotate every credential stored in NAKIVO's inventory.
5. Confirm that backups are intact and that you have an offline or immutable copy.

How to tell if you were hit#

Search proxy and firewall logs for requests to /c/router from addresses outside your management network. Check vCenter, ESXi, Hyper-V, cloud and NAS logs for logins with NAKIVO's service accounts from unexpected sources. Review job history for deleted backups or changed retention. watchTowr's detection artifact generator can confirm that your own Director is fixed.

Timeline#

• Sep 13, 2024 — watchTowr reports the bug to NAKIVO.
• Nov 4, 2024 — Version 11.0.0.88174 ships the fix.
• Feb 26, 2025 — watchTowr publishes details and a detection tool.
• Mar 6, 2025 — NAKIVO's advisory is last modified.
• Mar 19, 2025 — CISA adds the CVE to KEV (due Apr 9).
• Mar 22, 2025 — QNAP publishes QSA-25-08.

Vulnerability records

• CVE-2024-48248 · KEV 2025-03-19 · NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. NAKIVO — Security Advisory: CVE-2024-48248 helpcenter.nakivo.com
2. NAKIVO — Release Notes helpcenter.nakivo.com
3. watchTowr Labs — The Best Security Is When We All Agree To Keep Everything Secret (Except The Secrets) - NAKIVO Backup & Replication (CVE-2024-48248) labs.watchtowr.com
4. CVE record — CVE-2024-48248 cve.org
5. NVD — CVE-2024-48248 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2024-48248 cisa.gov
7. QNAP — QSA-25-08: Vulnerability in NAKIVO Backup & Replication qnap.com
8. watchTowr Labs — NAKIVO CVE-2024-48248 detection artifact generator (GitHub) github.com

Coverage and analysis

1. Help Net Security — NAKIVO Backup & Replication vulnerability exploited by attackers (CVE-2024-48248) helpnetsecurity.com
2. SecurityWeek — CISA Warns of Exploited Nakivo Vulnerability securityweek.com