CVE-2025-43596

CRITICAL 9.8CVE-2025-43596 · Published 22/05/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
backup msp360	`≥ 8.0, < 8.1.1.19`	`8.1.1.19`

Description

An insecure file system permissions vulnerability in MSP360 Backup 8.0 allows a low privileged user to execute commands with SYSTEM level privileges using a specially crafted file with an arbitrary file backup target. Upgrade to MSP360 Backup 8.1.1.19 (released on 2025-05-15).

References

help.msp360.com/cloudberry-backup/security/admin-privileges · Product
help.msp360.com/cloudberry-backup/whats-new · Release Notes
raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-119-01.json · Third Party Advisory
cve.org/CVERecord · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free