CVE-2025-32991
In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.
Published Mar 25, 2026 · updated Jun 17, 2026 · n2w backup& recovery
In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 25, 2026 · NIST NVD
Detected
In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.
Jun 17, 2026 · NIST NVD
Updated
In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.
Affected
- cpe n2w/backup& recoveryversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2025-32991
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2025-32991
In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.
nvd.nist.gov