Historical catalog analysis: CISA added this entry on March 19, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2024-48248 is an absolute path traversal vulnerability (CWE-36) identified in NAKIVO Backup and Replication. This flaw allows an attacker to read arbitrary files from the system where the software is deployed. On March 19, 2025, CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating that the flaw has been observed in active exploitation.
Exposure and applicability
This vulnerability is particularly relevant to healthcare organizations, covered entities, and business associates that utilize NAKIVO for their backup infrastructure. Under the HIPAA Security Rule, ensuring the availability and confidentiality of electronic Protected Health Information (ePHI) is a primary requirement.
Because backup servers often hold consolidated copies of sensitive data and administrative credentials necessary for disaster recovery, a vulnerability that enables arbitrary file reading could potentially be used to access configuration files, system secrets, or stored backups. This creates a risk where an attacker might gain insights into the environment or extract sensitive information without needing to modify or delete data.
Remediation priorities
Based on the CISA KEV listing and the nature of backup infrastructure, we suggest the following prioritized actions:
- Immediate Patching/Mitigation: Administrators should apply the mitigations provided by the vendor. For those utilizing cloud-based services, following BOD 22-01 guidance is recommended where applicable.
- Access Control Review: Ensure that the backup server is isolated from general network traffic and accessible only to authorized administrative roles. This limits the potential for an external attacker to reach the vulnerable interface.
- Credential Rotation: If it is determined that the system was exposed, security leaders should consider rotating credentials stored on or managed by the backup server, as these may have been targeted via arbitrary file reading.
How to validate remediation
To verify that exposure has been reduced, organizations should:
* Confirm Versioning: Verify that the installed version of NAKIVO Backup and Replication matches the patched version specified in the vendor’s release notes.
* Audit Access Logs: Review system logs for unusual file access patterns or unauthorized requests targeting system directories, which could indicate attempted exploitation of path traversal.
* Configuration Audit: Confirm that the backup server is not exposed to the public internet and resides within a restricted management VLAN.
Limits and open questions
It remains unknown whether this vulnerability has been utilized in specific ransomware campaigns. Additionally, while CISA has set a remediation deadline for federal agencies (April 9, 2025), this date is not a legal mandate for private healthcare providers, though it serves as a critical benchmark for risk management.
Applying patches could reduce the likelihood of exploitation, but does not guarantee total prevention. Residual risk remains if other vulnerabilities exist within the environment or if administrative credentials have already been compromised.
Source and editorial note
CVE-2024-48248: NAKIVO Backup and Replication Absolute Path Traversal Vulnerability · Source date: March 19, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: March 22, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 17, 2026 at 00:47 UTC.
Request a healthcare security assessment
Turn healthcare security intelligence into action.
Discuss your environment, priorities, and the evidence needed to validate safeguards.
Request a healthcare assessment ↗