CVE-2025-43595 is a high severity (CVSS 7.8) insecure file system permissions flaw in MSP360 Backup 4.3.1.115, the Linux edition. A low privileged user can run commands as root through the Online Backup folder. The vendor says to upgrade to MSP360 Backup 4.4, released on 22 April 2025.
What's affected
The record lists MSP360 Backup 4.3.1.115 on Linux. The vendor guidance quoted in the record and in the CISA CSAF advisory VA-25-119-01 is to upgrade to MSP360 Backup 4.4, released on 2025-04-22.
MSP360 publishes release notes for the Linux and Mac edition. The fetched notes list version 4.4 dated 22 April 2025 with the line that it improved security features, followed by later releases up to 4.4.4.425. Any release at or above 4.4 contains the fix according to the vendor statement, though you should apply the latest available build.
A separate entry, CVE-2025-43596, covers the Windows edition at a different version. This one concerns the Linux edition only.
How to check if you're exposed
On each Linux host that runs the MSP360 backup agent, check the installed version from the product's own interface or its package listing. Anything at 4.3.1.115 is in scope, and anything below 4.4 deserves an upgrade plan.
Then look at the Online Backup directory the advisory names. List its owner, group and mode with ls -ld and review the files inside it. If ordinary users can write there, the weakness described in the record is present in your setup, even on an updated host that was copied from an old image.
Use your MSP or RMM console to list agent versions across customers or sites in bulk, because backup agents tend to be installed once and left alone.
What to do now
- List all Linux hosts running MSP360 Backup and their versions.
- Upgrade each one to 4.4 or later, preferably the newest build from the vendor release notes.
- Check the permissions on the Online Backup directory after the upgrade and correct any that allow writes by ordinary users.
- Limit shell access on backup hosts to the people who need it.
- Review recent root activity on those hosts for commands you cannot explain.
- Add the agent version to your monitoring so a future regression is visible.
Why it matters
The class is incorrect default permissions, CWE-276 (Incorrect Default Permissions). A directory used by a root level process was writable by ordinary users, so whatever a low privileged user put there could be run with root rights.
The vector says local access and low privileges. It is not remotely exploitable on its own, but it turns a minor foothold, such as a compromised service account or a shared jump host, into full control of a backup server. Backup servers are valuable because they hold copies of everything and often hold storage credentials as well.
The CISA CSAF document records the vendor fix and an SSVC assessment, and the record does not say the flaw is exploited in the wild. It is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes this?
MSP360 Backup 4.4, released on 22 April 2025, according to the vendor guidance in the record and the CISA CSAF advisory. Newer 4.4.x builds exist.
Can a remote attacker use it?
Not directly. The vector requires local access with low privileges, so the risk is highest on hosts where several people or services have shell accounts.
Sources
- Gold entry for CVE-2025-43595
- MSP360 Backup for Mac and Linux release notes
- CISA CSAF advisory VA-25-119-01
Last reviewed: 18 October 2026.
