PT-2026-27778 · Unknown · N2Ws Backup & Recovery

Published 2026-03-25 · Updated 2026-03-25 · CVE-2025-32991

Positive Technologies · (AI Summary)

CVSS v3.1

9.0

Critical

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions N2WS Backup & Recovery versions prior to 4.4.0

Description A two-step attack against the RESTful API can lead to remote code execution. The attack targets the API, potentially allowing an attacker to execute arbitrary code on the system. The API endpoints and vulnerable parameters are not specified.

Recommendations Update to version 4.4.0 or later.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2025-32991

Affected Products

N2Ws Backup & Recovery

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-32991 · Security Note
• https://n2ws.com/blog/security-advisory-update · Note
• https://n2ws.com · Note
• https://twitter.com/CveFindCom/status/2036846255502991471 · Twitter Post