Yes. CISA added CVE-2024-48248 to its Known Exploited Vulnerabilities catalogue on 19 March 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files. Any organisation running the affected product should treat remediation as urgent.
What active exploitation means for this CVE
CISA’s KEV listing is the practical signal to trust here, because it means the vulnerability is not just theoretical. For NAKIVO Backup and Replication, the issue is an absolute path traversal that can let an attacker read files outside the intended directory boundary, so the question is not whether it is worth attention, but whether you have exposure and have already reduced blast radius.
Because the weakness is file-access oriented, the first operational concern is what sensitive data the product can reach on the host. That may include configuration files, secrets, backup metadata, logs, and anything else stored where the application runs with sufficient read permissions. Treat the product as a high-value target until you have confirmed whether the vulnerable instance is internet-facing, internally reachable, or already fenced by compensating controls.
Confirmation should be evidence-based rather than assumed. Verify whether NAKIVO Backup and Replication is deployed anywhere in the estate, whether it is exposed to untrusted networks, and whether the platform’s file paths, permissions, and logging would have made arbitrary file reads useful to an attacker. The vendor advisory and the CISA Known Exploited Vulnerabilities Catalog should be the source of version and remediation details, not an estimate from secondary reporting.
Why this vulnerability matters operationally
Arbitrary file read bugs often look modest on paper but become serious when they land in backup and recovery software. Backup platforms tend to have broad access to credentials, repositories, administrative settings, and recovery workflows, so a path traversal flaw can expose information that helps an attacker pivot, persist, or accelerate follow-on compromise. The direct damage may be disclosure, but the indirect damage can be much wider.
The practical threat is that exposed files can reveal enough to weaken other controls. If secrets, tokens, stored credentials, or configuration material are exposed, the attacker may not need to exploit the same flaw again. That is why exploitation status matters so much here: once a KEV entry appears, defenders should assume the issue is reachable in the wild and prioritize containment, patching, and post-exposure review together.
Zero-Day and Exploited Vulnerabilities Guide is the best internal starting point for triage logic when a vulnerability has confirmed active exploitation, because it ties KEV status to emergency remediation, exposure checks, and post-patch hunting.
What to do when patching is delayed
If you cannot remediate immediately, reduce reachable exposure first. Restrict network access to the management interface, isolate the server segment, and remove any unnecessary trust from adjacent systems that can reach it. If the product is being used for backups, also review whether backup credentials or repository credentials are stored on the same host in a way that broadens the impact of a read-only compromise.
Then look for signs of earlier compromise instead of waiting for the patch window to close. Review application logs, web access logs, unusual file access patterns, and any evidence that configuration files or secrets were read unexpectedly. If the instance is exposed or has sensitive configuration on disk, assume credential rotation may be needed for anything the server could have revealed.
Vulnerability Management Guide supports the operational side of this response, especially the parts on KEV prioritisation, remediation SLAs, verification, and exception handling when a known exploited issue cannot be fixed at once.
Risk and Threat Considerations
Backup software concentrates trust, so a file traversal flaw in that layer can create outsize exposure. Even though the immediate vulnerability is read access, the likely impact is broader because backup platforms commonly sit near credentials, recovery data, and administrative configuration.
Failure mechanism: An attacker abuses path traversal to reach files outside the intended application boundary, then uses the disclosed material to deepen access, move laterally, or target adjacent systems that trust the backup environment.
Impact: Sensitive file disclosure can expose secrets, operational details, and recovery data, which may turn a single product flaw into a wider compromise or recovery disruption.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | KEV-listed exploitation requires risk-based prioritisation and remediation decisions. |
| Recommendation — Prioritise the vulnerable backup platform for immediate risk treatment and remediation. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | The issue depends on verifying exposure and tracking a known exploited vulnerability. |
| SI-2 — Flaw Remediation | Active exploitation makes timely fix deployment and exception handling material. | |
| Recommendation — Scan for the product, confirm exposure, and track remediation to closure. Apply the vendor fix or approved mitigation as soon as possible. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Known exploited vulnerabilities require rapid identification, prioritisation, and remediation. |
| CIS-4 — Secure Configuration of Enterprise Assets and Software | Reducing reachability and exposure is central when patching must wait. | |
| Recommendation — Use KEV status to drive urgent remediation and verification. Harden and isolate the backup server until remediation is complete. | ||
Practitioner Guidance
What to prioritise: Confirm whether NAKIVO Backup and Replication is present anywhere in the environment, whether it is externally reachable, and whether it can access sensitive files or secrets on the host. If yes, treat the asset as priority remediation and not as a routine vulnerability ticket.
What to verify: Validate the vendor’s fixed guidance against every deployed instance, then check whether any files readable by the application would materially help an attacker, such as configuration, credentials, or backup metadata. If the answer is yes, plan for both patching and targeted rotation of exposed secrets.
Practitioner takeaway: KEV inclusion changes the decision from “should we care?” to “how fast can we reduce exposure and verify whether the server already leaked something useful?”
Related resources from NHI Mgmt Group
- How do you patch or mitigate CVE-2024-48248 (NAKIVO Backup and Replication Absolute Path Traversal)?
- CVE-2024-48248 (NAKIVO Backup and Replication Absolute Path Traversal)
- Is CVE-2024-13159 (Ivanti Endpoint Manager (EPM) Absolute Path Traversal) being exploited in the wild?
- Is CVE-2024-13161 (Ivanti Endpoint Manager (EPM) Absolute Path Traversal) being exploited in the wild?