IT weekly review: patch Veeam, assess storage alerts and prepare Windows servicing

This review covers October 4, 18:00 to October 11, 18:00, 2026, Europe/Berlin. Three developments matter for on-premises operations: a security update for Veeam's version 12 estate, new guidance on denied bucket-listing requests, and advance notice of Windows Update certificate expiry. The immediate priority is the backup server; storage alerts and server update readiness need separate decisions. The checks below are operational recommendations. They turn vendor announcements into evidence that a named administrator can collect without confusing an installed patch, a quiet dashboard or an old update policy with a working recovery and servicing path.

Veeam published KB4934 and released Backup & Replication 12.3.2 P4, build 12.3.2.4934, on October 6. The advisory covers version 12 builds through 12.3.2.4854; version 13 is unaffected by these specific vulnerabilities. CVE-2025-64393 permits remote code execution by a Backup Viewer through the Mount Service and is rated critical, CVSS 9.4. KB4696 identifies the installation route: selected 12.3.2 builds can use the smaller patch, while older supported upgrade sources require the full ISO. A reboot may be necessary. The patch therefore needs an explicit maintenance window rather than an unattended assumption about completion.

Start with an inventory of backup servers, consoles and installed builds, then record who holds Backup Viewer access. My recommendation is to prioritize affected servers even when management access is restricted: a low-privilege account still belongs in the threat model. Read the upgrade checklist, preserve a recoverable configuration backup and choose the installer for the actual starting build. After the change, confirm the target build, component status and one representative backup followed by an isolated restore. Record the result and owner. Treat a version 13 migration as a separate compatibility project; a major upgrade need not replace a focused security change.

Veeam published KB4935 on October 6 for S3-compatible repositories across the listed version 12, 13 and 13.1 products. Bucket-listing requests can produce Access Denied entries in storage logs even when the repository's bucket is explicitly specified. Veeam confirms unnecessary calls as a product issue; the missing listing permission does not prevent normal backup or restore operations. A fix is planned for a future release. No fixed build is announced.

Correlate each alert with the operation, repository identity, timestamp and actual job outcome before changing permissions. For this documented case, I would keep the existing restricted access and narrow the monitoring exception to the confirmed bucket-listing call. Preserve alerts for denied object reads, writes or deletions and for failed jobs. If policy requires every such log entry to disappear, Veeam offers granting bucket-listing permission as an alternative; document that broader visibility and its approver. Then test backup and restore using the same repository identity. A storage log and the backup console describe different parts of the path, so retain both in the incident evidence.

Microsoft announced Windows Update certificate-rotation guidance on October 8. The expiry events are May 17 and June 19, 2027, not this week. Windows Server 2025 needs the September 2025 security update or later before June 19; Server 2022 needs July 2026 or later by that date. Server 2016 and 2019 need July 2026 or later before May 17. Supported, current systems already have the replacement certificates. Microsoft explicitly excludes devices receiving updates through WSUS from this change. Those distinctions make OS version, servicing level and update source more useful than a fleet-wide certificate replacement campaign.

Use existing inventory or a read-only PowerShell collection to connect server version, installed servicing level, effective update source and owner. Include seldom-started recovery machines and administrative hosts where they receive updates directly from Windows Update. My proposed acceptance check is a successful update scan through the intended path plus evidence of the required or a later security update; a configured policy alone is insufficient. Put offline systems and unsupported versions into an owned remediation plan before the relevant deadline. Recheck machines restored from older images. Keep WSUS populations separately documented so that an exclusion in this notice does not erase their ordinary patching responsibilities.

For the next change window, produce three short records: the affected Veeam servers and their verified target builds, a reviewed exception for the precise S3 listing alert, and a Windows servicing inventory with the applicable 2027 deadline. Attach the recovery test, permission decision and update-scan evidence respectively. The practical lesson is to separate urgent remediation from diagnostic clarification and advance planning. Give each item an owner and a completion criterion, and leave incomplete checks visible. That creates a useful weekly review for the operations team: a small set of decisions tied to the actual versions and services it runs.