EUVD-2026-23438Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.
AnalysisAI
Bypass of Windows Driver Signature Enforcement in Veeam Backup and Replication 12.x and Software Appliance 13.x allows local administrators to load unsigned kernel drivers, potentially enabling persistent kernel-level compromise. The vulnerability requires high-level administrative privileges and is not actively exploited in the wild; however, EPSS scoring (0.01%) suggests this is a low-probability exploitation target despite the high CVSS score, indicating the attack scenario is constrained by strict privilege and configuration requirements.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess local administrative privileges on a Windows system running Veeam Backup and Replication 12.x (before 12.3.2) or Veeam Software Appliance 13.x (before 13.0.1). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The risk profile presents a notable discrepancy between CVSS and real-world exploitation signals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A disgruntled system administrator with local access to a Veeam Backup and Replication server crafts a malicious command through the administrative interface or local service interaction, injecting parameters that bypass Driver Signature Enforcement validation. This allows the attacker to load an unsigned kernel driver that persists across reboots and operates with system-level privileges, potentially exfiltrating data, modifying backups, or installing additional malware. … |
| Remediation | Upgrade Veeam Backup and Replication to version 12.3.2 or later, and upgrade Veeam Software Appliance to version 13.0.1 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today