Which versions of Veeam Backup & Replication are affected by EUVD-2026-47595?

Veeam Backup & Replication's hardened appliance variant contains a local privilege escalation vulnerability (CVE-2026-56844, CVSS 8.4) that allows high-privilege local users to achieve root-level…

How to fix or mitigate EUVD-2026-47595?

Within 24 hours, conduct a complete inventory of Veeam Backup & Replication deployments to identify which systems use the hardened software appliance variant and which local users have elevated privileges. Within 7 days, implement network segmentation to restrict local access to affected appliances, enforce multi-factor authentication for all administrative accounts, and configure EDR or system monitoring to alert on privilege escalation attempts. Within 30 days, contact Veeam support directly to obtain the latest security advisory and expected patch timeline for CVE-2026-56844; establish a formal monitoring schedule to check for patch availability weekly and prepare a deployment runbook in advance.

Veeam Backup & Replication EUVD-2026-47595

Q: What is the CVSS score of EUVD-2026-47595?

EUVD-2026-47595 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-56844 HIGH

Path Traversal (CWE-22)

2026-07-22 hackerone

GHSA-72f6-c934-4fg9

Path Traversal Backup And Replication Veeam

8.4

CVSS 4.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.7 MEDIUM

Local Updater flaw needs an existing privileged appliance account (AV:L, PR:H), no user interaction and low complexity, yielding root-level full CIA impact with no scope change.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:37 vuln.today

CVE Published

Jul 22, 2026 - 00:44 cve.org

HIGH 8.4

DescriptionCVE.org

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system.

AnalysisAI

Local privilege escalation in the Veeam Updater component of the Veeam Software Appliance allows a high-privileged local user to reach root-level control of the underlying operating system via path traversal (CWE-22). The flaw affects Veeam Backup & Replication deployed as the hardened software appliance, carries a CVSS 4.0 base score of 8.4, and was reported through HackerOne. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so current risk is latent rather than actively exploited.

Technical ContextAI

The Veeam Software Appliance is a purpose-built, hardened Linux-based appliance that ships the Veeam Backup & Replication data-protection platform (CPE cpe:2.3:a:veeam:backup_and_replication). The affected element is the Updater component - the service responsible for fetching and applying appliance/product updates, which typically runs with elevated (root) privileges. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): the updater resolves file paths without properly constraining them to an intended directory, so a caller who can influence those paths can read from or write to arbitrary filesystem locations. When a traversal write is combined with a process running as root, it converts a limited appliance account into full OS-level compromise.

RemediationAI

Patch available per vendor advisory: apply the fix described in Veeam KB4879 (https://www.veeam.com/kb4879) to the Veeam Software Appliance; the exact fixed build number was not included in the provided data, so consult that KB to confirm the target version before deployment. Because exploitation requires an existing authenticated privileged local account, the primary compensating controls are to tightly restrict and audit who can log in to or run processes on the appliance: limit appliance shell/console access to a minimal set of trusted administrators, enforce strong authentication and remove unnecessary local accounts, and monitor the Updater component and filesystem for anomalous path/file writes. Avoid granting operational accounts more privilege than required. These access restrictions shrink the pool of potential attackers but do not fix the traversal flaw, so patching remains mandatory.