Veeam
Monthly
Remote code execution as LocalSystem in the Veeam Management Pack for Microsoft System Center Collector service lets any authenticated domain user who can reach the Collector over the network run arbitrary code at the highest local privilege level on the host. Only the Collector role is affected, and only in Management Pack versions 9.0 through below 13.1.0.334; the CVSS vector (PR:L, AC:L, UI:N) confirms a low-complexity path that needs a valid domain account but no user interaction. Veeam has released a fixed build (13.1.0.334) and the issue is tracked as a this-week priority, but no public exploit code has been identified at time of analysis and there is no CISA KEV entry.
Remote code execution in the Veeam Management Pack for Microsoft System Center Collector service allows an authenticated member of the Veeam Virtualization Extensions Users group to run arbitrary code on affected Collector servers, with high confidentiality, integrity and availability impact and a scope change to subsequent systems. Exploitation requires user interaction and a specific attack precondition noted in the CVSS 4.0 vector, so opportunistic unauthenticated attacks are not indicated; installations at 13.1.0.334 or later are not affected. Vendor patching is available, and no public exploit or CISA KEV entry is identified in the provided intelligence.
Veeam ONE 13.1 (through build 13.1.0.7233) exposes a global multi-factor authentication toggle that can be used before the operator's own second-factor check completes, so an attacker who already holds valid Administrator credentials can switch MFA off for the whole deployment and then authenticate with the password alone. The CVSS 4.0 score of 8.5 with PR:H reflects that this is not an initial-access path: it converts a stolen or guessed administrator password into full administrative control by removing the second factor, with high confidentiality and integrity impact and no availability impact. No public exploit code and no confirmed active exploitation are identified in the available data, and the priority label places remediation in the current week rather than as an emergency.
Authorization bypass in the CDP Coordinator Service of Veeam Backup & Replication 13.x allows unauthenticated remote attackers to take actions the service should have refused, with high integrity and availability impact and a scope change into other components; confidentiality impact is not indicated. Installations running 13.0 before 13.0.3 or 13.1 before 13.1.2 are affected, and exposure depends on whether the CDP Coordinator Service is reachable from untrusted networks. Vendor fixes exist (13.0.3 and 13.1.2 per Veeam KB4948), the issue carries an act_now priority decision, and no public exploit code or confirmed active exploitation was identified in the available sources.
Veeam Backup for Microsoft 365 8.0 through 8.5.0.1014 lets an account that already holds the product's Administrator role read arbitrary files on the backup server at LocalSystem privilege level, exposing host files and backup data to a high-privileged insider or to anyone who compromises an admin account. The underlying problem is a missing or incorrect authorization check (CWE-863) reachable over the network with low complexity and no user interaction, but it is gated on Administrator-level console access rather than being anonymously exploitable. No public exploit code has been identified at time of analysis.
SQL injection in Veeam M365 Backup 8.0 through 8.5.0.1014 lets an authenticated organization-transfer peer inject into the configuration database, enabling cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account. The issue is rated act_now, but exploitation requires a legitimate organization-transfer peer relationship and use of organization-transfer functionality, which limits exposure to configured multi-tenant/transfer scenarios rather than default standalone installations. No public exploit identified at time of analysis.
Local privilege escalation in Veeam Agent for Linux 13.1 allows a local low-privileged user to gain elevated privileges on hosts whose agent installation is managed by a Veeam Backup & Replication instance; standalone/unmanaged deployments are not affected. The flaw is an untrusted search path (CWE-426), the vendor has released a fix in 13.1.2, and no public exploit identified at time of analysis. This is a genuine but moderate-priority issue rather than an emergency.
Authenticated Cloud Connect tenants can read arbitrary files on the Veeam Backup & Replication service provider host through a path traversal flaw (CWE-22). This affects service providers that deploy the Cloud Connect feature and serve tenants; standalone installations without Cloud Connect are not reachable via this tenant path. The attack is network-reachable and low-complexity with no user interaction, but impact is limited to read-only disclosure and no public exploit code or confirmed active exploitation has been identified at time of analysis. This is a credible, above-average priority for Veeam Cloud Connect service providers, though not a drop-everything emergency on current signals.
NTLM credential capture in Veeam ONE exposes the Reporter service account to any low-privileged authenticated user over the network, enabling theft of service account credentials without user interaction. The captured Net-NTLMv2 hash can be relayed or cracked offline to compromise other systems in the environment, reflected by the high subsequent-system impact scores (SC:H/SI:H/SA:H) in the CVSS 4.0 vector. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the attack technique is well-understood and Veeam backup infrastructure is a high-value ransomware target.
Authentication coercion in Veeam ONE lets an unauthenticated network attacker force the Veeam ONE service account to perform outbound SMB authentication to an attacker-chosen destination, exposing the account's NTLM credentials for capture and relay. The flaw (CWE-288, CVSS 4.0 base 9.3) is remotely triggerable with no privileges or user interaction and carries high subsequent-system impact, meaning captured service-account credentials can be relayed to pivot onto other systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write in Veeam Service Provider Console (VSPC) lets an authenticated, low-privileged remote attacker plant or overwrite files on the management server via path traversal (CWE-22), which can be escalated to remote code execution on that server. All versions matched by the wildcard CPE are provisionally in scope pending vendor confirmation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.0 (Critical), driven by high confidentiality, integrity and availability impact plus subsequent-system impact.
Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privileged authenticated users via a network-accessible code injection flaw (CWE-94). The vulnerability carries a CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system, reported through HackerOne and detailed in Veeam KB4892. No public exploit code or CISA KEV listing has been identified at time of analysis, moderating near-term mass-exploitation risk despite the critical impact class.
Credential theft via agent impersonation in Veeam Service Provider Console (VSPC) allows a remote, unauthenticated attacker to masquerade as a legitimately managed backup agent and harvest that agent's credentials. Because VSPC is the multi-tenant management plane MSPs use to orchestrate backups across customer estates, captured agent credentials give an attacker a foothold to pivot into managed endpoints. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it critical (9.5) and CWE-288 identifies an authentication-bypass root cause.
SQL injection in Veeam ONE ≤ 13.0.2 allows any authenticated low-privileged user to extract database contents over the network. The CVSS 4.0 vector records high subsequent-system confidentiality, integrity, and availability impact (SC:H/SI:H/SA:H), indicating the backend database contains infrastructure-sensitive data - backup job configurations, managed-system credentials, or topology records - whose compromise extends well beyond the Veeam ONE console itself. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.27% (18th percentile), consistent with SSVC exploitation status of 'none'.
Unauthenticated arbitrary file read in Veeam ONE exposes sensitive server-side files to remote attackers without requiring any credentials, user interaction, or special configuration. The flaw, rooted in CWE-287 (Improper Authentication), enables a network-accessible authentication bypass that returns host filesystem content directly to the attacker. Exfiltrated files - likely including configuration data, database connection strings, or stored credentials - can then be used to escalate privileges locally, extending the impact beyond the initial confidentiality breach. No public exploit or active exploitation confirmed at time of analysis.
Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on the agent host over the network with no credentials or user interaction. The flaw is a CWE-94 code injection carrying a maximal CVSS 4.0 base score of 10.0, reflecting full compromise of both the vulnerable and downstream systems. Reported via HackerOne with a Veeam KB advisory published; no public exploit has been identified at time of analysis.
Veeam ONE's Reporter service exposes an improper privilege management flaw (CWE-269) that enables a locally authenticated, high-privileged user to escalate into the Reporter service's security context, achieving full confidentiality, integrity, and availability impact on the vulnerable system. All versions of the product appear affected per the wildcard CPE string, and the vulnerability was responsibly disclosed via HackerOne. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated Portal Administrator impersonation in Veeam Service Provider Console (VSPC) exposes the proxied appliance API to unauthorized access during a short race window that opens immediately after a legitimate administrator session is initiated. The flaw, rooted in CWE-306 (Missing Authentication for Critical Function), allows a network attacker without any credentials to issue API calls that the system processes with Portal Administrator privileges. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the managed service provider management role targeted makes this a significant concern for MSP environments.
Memory exhaustion in Veeam Service Provider Console (VSPC) allows unauthenticated remote attackers to deplete host memory and cause a denial of service, with no authentication or user interaction required. The CVSS 4.0 score of 8.7 reflects the network-accessible, zero-prerequisite nature of exploitation (AV:N/AC:L/AT:N/PR:N/UI:N) with high availability impact confined to the vulnerable system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low exploitation barrier makes any internet-exposed VSPC instance a realistic target.
Local privilege escalation in the Veeam Updater component of the Veeam Software Appliance allows a high-privileged local user to reach root-level control of the underlying operating system via path traversal (CWE-22). The flaw affects Veeam Backup & Replication deployed as the hardened software appliance, carries a CVSS 4.0 base score of 8.4, and was reported through HackerOne. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so current risk is latent rather than actively exploited.
Remote code execution in Veeam Backup & Replication enables an authenticated domain user to execute arbitrary code on the Backup Server, with CVSS 4.0 score of 9.4 reflecting high impact across confidentiality, integrity, and availability of both the vulnerable component and downstream systems. The vulnerability is tagged as a deserialization flaw (CWE-502), and while no public exploit is identified at time of analysis, the low attack complexity and only-low-privilege requirement make this a high-priority patching event for any environment running Veeam in a domain-joined configuration.
Remote code execution in Veeam Service Provider Console versions 9.0 through 9.2 allows authenticated remote attackers to execute arbitrary code on the server, per the CVSS 4.0 vector requiring low privileges (PR:L) over the network. With a CVSS score of 9.4 and a scope change indicating impact beyond the vulnerable component (SC:H/SI:H/SA:H), successful exploitation could compromise managed downstream customer environments. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Arbitrary file write in Veeam Backup & Replication 13 (≤13.0.1) on Linux-based deployments allows an authenticated Backup Administrator to write files anywhere on the server filesystem, enabling code execution and full host compromise. CVSS 4.0 scores this 8.6 (High) due to network-reachable exploitation with high impact across confidentiality, integrity, and availability, though high privileges are required. No public exploit identified at time of analysis.
Local privilege escalation in Veeam Agent for Microsoft Windows enables a low-privileged authenticated user to escalate to higher privileges on the host, with the CWE-532 mapping indicating sensitive information is exposed via log files that the attacker can read or abuse. CVSS 4.0 base score is 7.3 with high impact to confidentiality, integrity, and availability of the vulnerable component, and no public exploit identified at time of analysis. The flaw is tied to the broader Veeam Backup and Replication 13 ecosystem (≤13.0.1 per ENISA EUVD), making it relevant on any Windows endpoint where the Veeam Agent is deployed alongside or as part of that platform.
Veeam Backup & Replication allows a user with the Backup Viewer role (read-only) to escalate to remote code execution as the postgres database user. A read-only role achieving RCE represents a severe privilege escalation with scope change.
Veeam Backup & Replication allows Backup Administrators to achieve RCE in high-availability deployments. While requiring admin-level access, the scope change to the HA infrastructure makes this critical for organizations running Veeam in HA mode.
Unauthorized SSH credential extraction affects systems where low-privileged users can access stored authentication material, enabling account compromise without administrative access. The network-accessible vulnerability requires valid user credentials to exploit but impacts the entire system's security posture by exposing sensitive SSH keys. No patch is currently available to remediate this issue.
Yet another Veeam Backup & Replication RCE vulnerability allowing authenticated domain users to execute code on the Backup Server with scope change (CVSS 9.9). Part of a cluster of related Veeam vulnerabilities disclosed together.
Authenticated domain users can bypass file access restrictions on Backup Repository systems to read, modify, or delete arbitrary files due to insufficient authorization controls. This high-severity flaw affects users with valid domain credentials and requires no user interaction to exploit. No patch is currently available for this vulnerability.
A second RCE vulnerability in Veeam Backup & Replication allows any authenticated domain user to execute code on the Backup Server with scope change. Same impact as CVE-2026-21666 but through a different attack vector.
Veeam Backup & Replication allows an authenticated domain user to achieve remote code execution on the Backup Server. With a scope change to CVSS 9.9, a compromised domain account can fully take over the backup infrastructure.
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Local, low-privileged users on a Windows host running Veeam Backup for Microsoft 365 can steer the installer into writing arbitrary files with SYSTEM privileges, creating a privilege-escalation or denial-of-service risk. Affected builds are 8.0 through 8.6.0.1102, and exploitation is constrained to the installation or upgrade window with administrator-initiated interaction; the assessed severity is low-to-moderate (CVSS 4.3 Medium), and no public exploit was identified at time of analysis.
Arbitrary file write in Veeam Backup & Replication 13.0 (before 13.0.3) and 13.1 (before 13.1.2) lets an authenticated user who holds the Restore Operator role and who also controls the contents of a NAS share that the server backs up plant attacker-chosen files at an arbitrary path on the backup server via relative path traversal. Both preconditions are confirmed attack requirements: a privileged, non-default backup role and write influence over backed-up NAS data, which confines realistic exposure to malicious insiders or attackers who have already compromised a privileged backup account or a NAS data source. No public exploit has been identified at time of analysis; the flaw is rated moderate severity (CVSS 4.0 base 5.9, assessed CVSS 3.1 6.4-equivalent vector AV:N/AC:H/PR:H/UI:N with high integrity impact and limited availability impact), and the vendor has released fixed builds.
REST API authentication in Veeam Backup for Microsoft 365 8.0 through 8.6.0.1102 can be bypassed by a remote, unauthenticated attacker using a forged federation token, but responses are limited to endpoints that do not call the backup service. That confines impact to low confidentiality exposure on that endpoint subset, with no integrity or availability impact and no access to backup-service operations. The issue is rated CVSS 6.9, no public exploit was identified at time of analysis, and the precise cryptographic verification flaw is not described in the available sources.
Arbitrary file write in Veeam Backup & Replication 13.x lets an authenticated holder of the Restore Operator role, who also controls the contents of a NAS share that the backup server protects, place attacker-authored files at an arbitrary path on the backup server via relative path traversal. Only Backup and Replication 13.0 before 13.0.3 and 13.1 before 13.1.2 are affected, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L) reflects a high-barrier integrity impact with no confidentiality loss and limited availability impact, since exploitation needs both the delegated role and a position of control over backup source data. This is a medium-severity (CVSS 4.0 base 5.9), high-barrier integrity flaw, not an emergency; no public exploit was identified at time of analysis and the issue is not in CISA KEV, with vendor fixes available in 13.0.3 and 13.1.2.
Local arbitrary file write in Veeam Agent for Microsoft Windows allows an authenticated low-privileged local user to escalate integrity impact when an administrator installs or runs the agent. The vulnerability requires a privileged install/run action during the attack window and a non-trivial precondition such as controlling a target filesystem path (e.g., junction/symlink), making exploitation gated and low-to-moderate priority. No public exploit was identified at time of analysis.
Cross-site scripting in Veeam Backup Enterprise Manager lets an attacker run arbitrary script in the browser of a portal user who opens a crafted link, potentially exposing session data or allowing actions in the victim's authenticated context. Exploitation is not autonomous: the attacker must already be able to reach the portal with a valid low-privileged account (CVSS PR:L) and must then persuade a logged-in portal user to open the crafted link (UI:A), which is why this is rated a genuinely moderate, not high-priority, issue at 4.8. No public exploit code has been observed and the vulnerability is not in CISA KEV; no EPSS score was supplied with the source data, so likelihood should be treated as bounded by the social-engineering and authentication prerequisites rather than as an opportunistic mass-exploitation risk.
Authenticated Backup Viewer accounts in Veeam Backup & Replication can modify the Enterprise Manager master key and stored antivirus-update credentials due to missing authorization (CWE-862), affecting deployments with Enterprise Manager and that low-privilege role. The issue is medium severity (CVSS 4.0 score 6.1) and requires valid Backup Viewer credentials plus an additional attack precondition, so it is not anonymous or unauthenticated exploitation; no public exploit identified at time of analysis. Veeam KB4934 is the referenced advisory for affected and fixed builds.
Local, low-privileged users on Windows hosts running Veeam Agent for Microsoft Windows can terminate arbitrary processes on the system - including security agents, endpoint protection services, and backup components - because the agent's process-control functionality performs no authorization check on the caller (CWE-862, Missing Authorization). Rated 6.8 by the vendor and assessed as medium severity (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is strictly local, requires a pre-existing authenticated low-privileged account, needs no user interaction, and affects only availability - no confidentiality or integrity impact is possible through this path. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; realistic risk climbs only on hosts where killing specific processes (for example EDR agents or the backup service itself) materially degrades protection or disrupts operations.
Authenticated users holding only the low-privileged 'Backup Viewer' role on Veeam Backup & Replication can leverage a deserialization flaw to execute arbitrary code as SYSTEM on the backup server, turning a read-only backup monitoring account into full control of the backup infrastructure (CVSS 9.4; CWE-502). The attack is network-reachable (AV:N) and requires no user interaction, but it is not unauthenticated: a valid Backup Viewer account or stolen credentials for that role are mandatory (PR:L), which realistically limits exposure to insiders, credential-theft scenarios, or attackers who have already chained into the environment. The high severity is compounded by the scope change (S:C) and full loss of confidentiality, integrity, and availability across the backup server and connected systems; no public exploit code or confirmed active exploitation was identified at time of analysis.
Credential exposure in Veeam Backup & Replication occurs when guest OS processing operations write privileged account credentials to a support log file in cleartext, leaving them recoverable by any local user with read permissions on that log. Documented via HackerOne and Veeam KB4902, this CWE-532 information disclosure flaw affects all tracked versions per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Incorrect authorization in Veeam ONE's shared report link feature permits a low-privileged authenticated user to retrieve report data beyond the intended scope boundary of that link. Exploitation requires a valid Veeam ONE account but no elevated privileges, and the attack is network-accessible with low complexity. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the straightforward exploitation path.
Password reset token hijacking in Veeam Service Provider Console 9.2 and earlier enables unauthenticated remote attackers to take over any portal user account by manipulating the returnUrl parameter in the Forgot Password workflow. An attacker who knows a target's email address initiates a password reset on their behalf, supplying an attacker-controlled domain via the unvalidated returnUrl parameter; the platform then generates a reset email whose link routes through the attacker's infrastructure, transmitting the one-time reset code upon the victim clicking it. Account takeover is achieved without requiring any credentials or prior access to the platform. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed; however, the technique is straightforward and the report originated from HackerOne, suggesting the attack vector is well-understood by researchers.
Bypass of Windows Driver Signature Enforcement in Veeam Backup and Replication 12.x and Software Appliance 13.x allows local administrators to load unsigned kernel drivers, potentially enabling persistent kernel-level compromise. The vulnerability requires high-level administrative privileges and is not actively exploited in the wild; however, EPSS scoring (0.01%) suggests this is a low-probability exploitation target despite the high CVSS score, indicating the attack scenario is constrained by strict privilege and configuration requirements.
Veeam allows Backup Operators to execute code as postgres via malicious interval or order parameters. Another operator-to-RCE escalation path with scope change.
Veeam allows Backup or Tape Operators to write files as root on the server. An operator-level role achieving root file write is a severe privilege escalation with scope change.
Command injection in Veeam Backup & Replication lets a Backup Administrator achieve remote code execution as the postgres OS user by supplying a malicious password parameter, earning a CVSS 3.1 base score of 9.1 (CWE-77). Exploitation is gated: it requires an authenticated account holding the privileged Backup Administrator role (PR:H) and does not need user interaction, but it is not reachable by an anonymous attacker, and the scope change (S:C) reflects the pivot from the backup application into the underlying PostgreSQL OS account. Threat signals are mixed rather than urgent - EPSS is only 0.11% (30th percentile) and no public exploit code has been identified at time of analysis, though the high privilege associated with the backup-admin role and the OS-level impact make this a serious issue for defenders to close via the vendor's KB4792 guidance.
Remote code execution as root in Veeam Backup & Replication allows an authenticated Backup Operator or Tape Operator to run arbitrary OS commands on the Veeam host by crafting a malicious backup configuration file. The vendor scores this 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the description itself establishes a privileged-role prerequisite, and our independent assessment rates it AV:N/AC:L/PR:L (authenticated low-privilege), meaning exploitation is gated behind an already-delegated Backup or Tape Operator account rather than being available to any unauthenticated network attacker. No user interaction is required, EPSS is low at 0.07% (22nd percentile), and no public exploit code has been identified at time of analysis; the severe root-level impact makes this a high-value target wherever those operator roles are delegated to less-trusted users.
Privilege escalation vulnerability in backup management systems that permits authenticated users with the Backup Operator role to modify backup job configurations and execute arbitrary code with system privileges. The vulnerability affects backup software implementations that fail to properly validate backup job modifications; attackers must possess valid Backup Operator credentials but face no additional complexity once authenticated. This vulnerability is not currently listed in CISA's KEV catalog, but the high CVSS score of 7.2 and code execution capability indicate significant risk to organizations managing sensitive backup infrastructure.
Remote code execution vulnerability in Backup Server that allows authenticated domain users to execute arbitrary code with high severity (CVSS 8.8). The vulnerability requires valid domain credentials but no user interaction, making it a significant risk for organizations with Backup Server deployments in Active Directory environments. If actively exploited or with public POC availability, this represents an immediate priority for patching.
A vulnerability allowing remote code execution (RCE) for domain users. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 26.3%.
Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. Rated high severity (CVSS 7.0). No vendor patch available.
A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuration settings, such as modifying the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escalating privileges to system-level access. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent is installed. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An incorrect permission assignment vulnerability allows an attacker to modify product configuration files. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Veeam Backup Enterprise Manager allows account takeover via NTLM relay. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Remote code execution as LocalSystem in the Veeam Management Pack for Microsoft System Center Collector service lets any authenticated domain user who can reach the Collector over the network run arbitrary code at the highest local privilege level on the host. Only the Collector role is affected, and only in Management Pack versions 9.0 through below 13.1.0.334; the CVSS vector (PR:L, AC:L, UI:N) confirms a low-complexity path that needs a valid domain account but no user interaction. Veeam has released a fixed build (13.1.0.334) and the issue is tracked as a this-week priority, but no public exploit code has been identified at time of analysis and there is no CISA KEV entry.
Remote code execution in the Veeam Management Pack for Microsoft System Center Collector service allows an authenticated member of the Veeam Virtualization Extensions Users group to run arbitrary code on affected Collector servers, with high confidentiality, integrity and availability impact and a scope change to subsequent systems. Exploitation requires user interaction and a specific attack precondition noted in the CVSS 4.0 vector, so opportunistic unauthenticated attacks are not indicated; installations at 13.1.0.334 or later are not affected. Vendor patching is available, and no public exploit or CISA KEV entry is identified in the provided intelligence.
Veeam ONE 13.1 (through build 13.1.0.7233) exposes a global multi-factor authentication toggle that can be used before the operator's own second-factor check completes, so an attacker who already holds valid Administrator credentials can switch MFA off for the whole deployment and then authenticate with the password alone. The CVSS 4.0 score of 8.5 with PR:H reflects that this is not an initial-access path: it converts a stolen or guessed administrator password into full administrative control by removing the second factor, with high confidentiality and integrity impact and no availability impact. No public exploit code and no confirmed active exploitation are identified in the available data, and the priority label places remediation in the current week rather than as an emergency.
Authorization bypass in the CDP Coordinator Service of Veeam Backup & Replication 13.x allows unauthenticated remote attackers to take actions the service should have refused, with high integrity and availability impact and a scope change into other components; confidentiality impact is not indicated. Installations running 13.0 before 13.0.3 or 13.1 before 13.1.2 are affected, and exposure depends on whether the CDP Coordinator Service is reachable from untrusted networks. Vendor fixes exist (13.0.3 and 13.1.2 per Veeam KB4948), the issue carries an act_now priority decision, and no public exploit code or confirmed active exploitation was identified in the available sources.
Veeam Backup for Microsoft 365 8.0 through 8.5.0.1014 lets an account that already holds the product's Administrator role read arbitrary files on the backup server at LocalSystem privilege level, exposing host files and backup data to a high-privileged insider or to anyone who compromises an admin account. The underlying problem is a missing or incorrect authorization check (CWE-863) reachable over the network with low complexity and no user interaction, but it is gated on Administrator-level console access rather than being anonymously exploitable. No public exploit code has been identified at time of analysis.
SQL injection in Veeam M365 Backup 8.0 through 8.5.0.1014 lets an authenticated organization-transfer peer inject into the configuration database, enabling cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account. The issue is rated act_now, but exploitation requires a legitimate organization-transfer peer relationship and use of organization-transfer functionality, which limits exposure to configured multi-tenant/transfer scenarios rather than default standalone installations. No public exploit identified at time of analysis.
Local privilege escalation in Veeam Agent for Linux 13.1 allows a local low-privileged user to gain elevated privileges on hosts whose agent installation is managed by a Veeam Backup & Replication instance; standalone/unmanaged deployments are not affected. The flaw is an untrusted search path (CWE-426), the vendor has released a fix in 13.1.2, and no public exploit identified at time of analysis. This is a genuine but moderate-priority issue rather than an emergency.
Authenticated Cloud Connect tenants can read arbitrary files on the Veeam Backup & Replication service provider host through a path traversal flaw (CWE-22). This affects service providers that deploy the Cloud Connect feature and serve tenants; standalone installations without Cloud Connect are not reachable via this tenant path. The attack is network-reachable and low-complexity with no user interaction, but impact is limited to read-only disclosure and no public exploit code or confirmed active exploitation has been identified at time of analysis. This is a credible, above-average priority for Veeam Cloud Connect service providers, though not a drop-everything emergency on current signals.
NTLM credential capture in Veeam ONE exposes the Reporter service account to any low-privileged authenticated user over the network, enabling theft of service account credentials without user interaction. The captured Net-NTLMv2 hash can be relayed or cracked offline to compromise other systems in the environment, reflected by the high subsequent-system impact scores (SC:H/SI:H/SA:H) in the CVSS 4.0 vector. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the attack technique is well-understood and Veeam backup infrastructure is a high-value ransomware target.
Authentication coercion in Veeam ONE lets an unauthenticated network attacker force the Veeam ONE service account to perform outbound SMB authentication to an attacker-chosen destination, exposing the account's NTLM credentials for capture and relay. The flaw (CWE-288, CVSS 4.0 base 9.3) is remotely triggerable with no privileges or user interaction and carries high subsequent-system impact, meaning captured service-account credentials can be relayed to pivot onto other systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write in Veeam Service Provider Console (VSPC) lets an authenticated, low-privileged remote attacker plant or overwrite files on the management server via path traversal (CWE-22), which can be escalated to remote code execution on that server. All versions matched by the wildcard CPE are provisionally in scope pending vendor confirmation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.0 (Critical), driven by high confidentiality, integrity and availability impact plus subsequent-system impact.
Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privileged authenticated users via a network-accessible code injection flaw (CWE-94). The vulnerability carries a CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system, reported through HackerOne and detailed in Veeam KB4892. No public exploit code or CISA KEV listing has been identified at time of analysis, moderating near-term mass-exploitation risk despite the critical impact class.
Credential theft via agent impersonation in Veeam Service Provider Console (VSPC) allows a remote, unauthenticated attacker to masquerade as a legitimately managed backup agent and harvest that agent's credentials. Because VSPC is the multi-tenant management plane MSPs use to orchestrate backups across customer estates, captured agent credentials give an attacker a foothold to pivot into managed endpoints. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it critical (9.5) and CWE-288 identifies an authentication-bypass root cause.
SQL injection in Veeam ONE ≤ 13.0.2 allows any authenticated low-privileged user to extract database contents over the network. The CVSS 4.0 vector records high subsequent-system confidentiality, integrity, and availability impact (SC:H/SI:H/SA:H), indicating the backend database contains infrastructure-sensitive data - backup job configurations, managed-system credentials, or topology records - whose compromise extends well beyond the Veeam ONE console itself. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.27% (18th percentile), consistent with SSVC exploitation status of 'none'.
Unauthenticated arbitrary file read in Veeam ONE exposes sensitive server-side files to remote attackers without requiring any credentials, user interaction, or special configuration. The flaw, rooted in CWE-287 (Improper Authentication), enables a network-accessible authentication bypass that returns host filesystem content directly to the attacker. Exfiltrated files - likely including configuration data, database connection strings, or stored credentials - can then be used to escalate privileges locally, extending the impact beyond the initial confidentiality breach. No public exploit or active exploitation confirmed at time of analysis.
Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on the agent host over the network with no credentials or user interaction. The flaw is a CWE-94 code injection carrying a maximal CVSS 4.0 base score of 10.0, reflecting full compromise of both the vulnerable and downstream systems. Reported via HackerOne with a Veeam KB advisory published; no public exploit has been identified at time of analysis.
Veeam ONE's Reporter service exposes an improper privilege management flaw (CWE-269) that enables a locally authenticated, high-privileged user to escalate into the Reporter service's security context, achieving full confidentiality, integrity, and availability impact on the vulnerable system. All versions of the product appear affected per the wildcard CPE string, and the vulnerability was responsibly disclosed via HackerOne. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated Portal Administrator impersonation in Veeam Service Provider Console (VSPC) exposes the proxied appliance API to unauthorized access during a short race window that opens immediately after a legitimate administrator session is initiated. The flaw, rooted in CWE-306 (Missing Authentication for Critical Function), allows a network attacker without any credentials to issue API calls that the system processes with Portal Administrator privileges. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the managed service provider management role targeted makes this a significant concern for MSP environments.
Memory exhaustion in Veeam Service Provider Console (VSPC) allows unauthenticated remote attackers to deplete host memory and cause a denial of service, with no authentication or user interaction required. The CVSS 4.0 score of 8.7 reflects the network-accessible, zero-prerequisite nature of exploitation (AV:N/AC:L/AT:N/PR:N/UI:N) with high availability impact confined to the vulnerable system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low exploitation barrier makes any internet-exposed VSPC instance a realistic target.
Local privilege escalation in the Veeam Updater component of the Veeam Software Appliance allows a high-privileged local user to reach root-level control of the underlying operating system via path traversal (CWE-22). The flaw affects Veeam Backup & Replication deployed as the hardened software appliance, carries a CVSS 4.0 base score of 8.4, and was reported through HackerOne. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so current risk is latent rather than actively exploited.
Remote code execution in Veeam Backup & Replication enables an authenticated domain user to execute arbitrary code on the Backup Server, with CVSS 4.0 score of 9.4 reflecting high impact across confidentiality, integrity, and availability of both the vulnerable component and downstream systems. The vulnerability is tagged as a deserialization flaw (CWE-502), and while no public exploit is identified at time of analysis, the low attack complexity and only-low-privilege requirement make this a high-priority patching event for any environment running Veeam in a domain-joined configuration.
Remote code execution in Veeam Service Provider Console versions 9.0 through 9.2 allows authenticated remote attackers to execute arbitrary code on the server, per the CVSS 4.0 vector requiring low privileges (PR:L) over the network. With a CVSS score of 9.4 and a scope change indicating impact beyond the vulnerable component (SC:H/SI:H/SA:H), successful exploitation could compromise managed downstream customer environments. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Arbitrary file write in Veeam Backup & Replication 13 (≤13.0.1) on Linux-based deployments allows an authenticated Backup Administrator to write files anywhere on the server filesystem, enabling code execution and full host compromise. CVSS 4.0 scores this 8.6 (High) due to network-reachable exploitation with high impact across confidentiality, integrity, and availability, though high privileges are required. No public exploit identified at time of analysis.
Local privilege escalation in Veeam Agent for Microsoft Windows enables a low-privileged authenticated user to escalate to higher privileges on the host, with the CWE-532 mapping indicating sensitive information is exposed via log files that the attacker can read or abuse. CVSS 4.0 base score is 7.3 with high impact to confidentiality, integrity, and availability of the vulnerable component, and no public exploit identified at time of analysis. The flaw is tied to the broader Veeam Backup and Replication 13 ecosystem (≤13.0.1 per ENISA EUVD), making it relevant on any Windows endpoint where the Veeam Agent is deployed alongside or as part of that platform.
Veeam Backup & Replication allows a user with the Backup Viewer role (read-only) to escalate to remote code execution as the postgres database user. A read-only role achieving RCE represents a severe privilege escalation with scope change.
Veeam Backup & Replication allows Backup Administrators to achieve RCE in high-availability deployments. While requiring admin-level access, the scope change to the HA infrastructure makes this critical for organizations running Veeam in HA mode.
Unauthorized SSH credential extraction affects systems where low-privileged users can access stored authentication material, enabling account compromise without administrative access. The network-accessible vulnerability requires valid user credentials to exploit but impacts the entire system's security posture by exposing sensitive SSH keys. No patch is currently available to remediate this issue.
Yet another Veeam Backup & Replication RCE vulnerability allowing authenticated domain users to execute code on the Backup Server with scope change (CVSS 9.9). Part of a cluster of related Veeam vulnerabilities disclosed together.
Authenticated domain users can bypass file access restrictions on Backup Repository systems to read, modify, or delete arbitrary files due to insufficient authorization controls. This high-severity flaw affects users with valid domain credentials and requires no user interaction to exploit. No patch is currently available for this vulnerability.
A second RCE vulnerability in Veeam Backup & Replication allows any authenticated domain user to execute code on the Backup Server with scope change. Same impact as CVE-2026-21666 but through a different attack vector.
Veeam Backup & Replication allows an authenticated domain user to achieve remote code execution on the Backup Server. With a scope change to CVSS 9.9, a compromised domain account can fully take over the backup infrastructure.
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Local, low-privileged users on a Windows host running Veeam Backup for Microsoft 365 can steer the installer into writing arbitrary files with SYSTEM privileges, creating a privilege-escalation or denial-of-service risk. Affected builds are 8.0 through 8.6.0.1102, and exploitation is constrained to the installation or upgrade window with administrator-initiated interaction; the assessed severity is low-to-moderate (CVSS 4.3 Medium), and no public exploit was identified at time of analysis.
Arbitrary file write in Veeam Backup & Replication 13.0 (before 13.0.3) and 13.1 (before 13.1.2) lets an authenticated user who holds the Restore Operator role and who also controls the contents of a NAS share that the server backs up plant attacker-chosen files at an arbitrary path on the backup server via relative path traversal. Both preconditions are confirmed attack requirements: a privileged, non-default backup role and write influence over backed-up NAS data, which confines realistic exposure to malicious insiders or attackers who have already compromised a privileged backup account or a NAS data source. No public exploit has been identified at time of analysis; the flaw is rated moderate severity (CVSS 4.0 base 5.9, assessed CVSS 3.1 6.4-equivalent vector AV:N/AC:H/PR:H/UI:N with high integrity impact and limited availability impact), and the vendor has released fixed builds.
REST API authentication in Veeam Backup for Microsoft 365 8.0 through 8.6.0.1102 can be bypassed by a remote, unauthenticated attacker using a forged federation token, but responses are limited to endpoints that do not call the backup service. That confines impact to low confidentiality exposure on that endpoint subset, with no integrity or availability impact and no access to backup-service operations. The issue is rated CVSS 6.9, no public exploit was identified at time of analysis, and the precise cryptographic verification flaw is not described in the available sources.
Arbitrary file write in Veeam Backup & Replication 13.x lets an authenticated holder of the Restore Operator role, who also controls the contents of a NAS share that the backup server protects, place attacker-authored files at an arbitrary path on the backup server via relative path traversal. Only Backup and Replication 13.0 before 13.0.3 and 13.1 before 13.1.2 are affected, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L) reflects a high-barrier integrity impact with no confidentiality loss and limited availability impact, since exploitation needs both the delegated role and a position of control over backup source data. This is a medium-severity (CVSS 4.0 base 5.9), high-barrier integrity flaw, not an emergency; no public exploit was identified at time of analysis and the issue is not in CISA KEV, with vendor fixes available in 13.0.3 and 13.1.2.
Local arbitrary file write in Veeam Agent for Microsoft Windows allows an authenticated low-privileged local user to escalate integrity impact when an administrator installs or runs the agent. The vulnerability requires a privileged install/run action during the attack window and a non-trivial precondition such as controlling a target filesystem path (e.g., junction/symlink), making exploitation gated and low-to-moderate priority. No public exploit was identified at time of analysis.
Cross-site scripting in Veeam Backup Enterprise Manager lets an attacker run arbitrary script in the browser of a portal user who opens a crafted link, potentially exposing session data or allowing actions in the victim's authenticated context. Exploitation is not autonomous: the attacker must already be able to reach the portal with a valid low-privileged account (CVSS PR:L) and must then persuade a logged-in portal user to open the crafted link (UI:A), which is why this is rated a genuinely moderate, not high-priority, issue at 4.8. No public exploit code has been observed and the vulnerability is not in CISA KEV; no EPSS score was supplied with the source data, so likelihood should be treated as bounded by the social-engineering and authentication prerequisites rather than as an opportunistic mass-exploitation risk.
Authenticated Backup Viewer accounts in Veeam Backup & Replication can modify the Enterprise Manager master key and stored antivirus-update credentials due to missing authorization (CWE-862), affecting deployments with Enterprise Manager and that low-privilege role. The issue is medium severity (CVSS 4.0 score 6.1) and requires valid Backup Viewer credentials plus an additional attack precondition, so it is not anonymous or unauthenticated exploitation; no public exploit identified at time of analysis. Veeam KB4934 is the referenced advisory for affected and fixed builds.
Local, low-privileged users on Windows hosts running Veeam Agent for Microsoft Windows can terminate arbitrary processes on the system - including security agents, endpoint protection services, and backup components - because the agent's process-control functionality performs no authorization check on the caller (CWE-862, Missing Authorization). Rated 6.8 by the vendor and assessed as medium severity (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is strictly local, requires a pre-existing authenticated low-privileged account, needs no user interaction, and affects only availability - no confidentiality or integrity impact is possible through this path. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; realistic risk climbs only on hosts where killing specific processes (for example EDR agents or the backup service itself) materially degrades protection or disrupts operations.
Authenticated users holding only the low-privileged 'Backup Viewer' role on Veeam Backup & Replication can leverage a deserialization flaw to execute arbitrary code as SYSTEM on the backup server, turning a read-only backup monitoring account into full control of the backup infrastructure (CVSS 9.4; CWE-502). The attack is network-reachable (AV:N) and requires no user interaction, but it is not unauthenticated: a valid Backup Viewer account or stolen credentials for that role are mandatory (PR:L), which realistically limits exposure to insiders, credential-theft scenarios, or attackers who have already chained into the environment. The high severity is compounded by the scope change (S:C) and full loss of confidentiality, integrity, and availability across the backup server and connected systems; no public exploit code or confirmed active exploitation was identified at time of analysis.
Credential exposure in Veeam Backup & Replication occurs when guest OS processing operations write privileged account credentials to a support log file in cleartext, leaving them recoverable by any local user with read permissions on that log. Documented via HackerOne and Veeam KB4902, this CWE-532 information disclosure flaw affects all tracked versions per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Incorrect authorization in Veeam ONE's shared report link feature permits a low-privileged authenticated user to retrieve report data beyond the intended scope boundary of that link. Exploitation requires a valid Veeam ONE account but no elevated privileges, and the attack is network-accessible with low complexity. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the straightforward exploitation path.
Password reset token hijacking in Veeam Service Provider Console 9.2 and earlier enables unauthenticated remote attackers to take over any portal user account by manipulating the returnUrl parameter in the Forgot Password workflow. An attacker who knows a target's email address initiates a password reset on their behalf, supplying an attacker-controlled domain via the unvalidated returnUrl parameter; the platform then generates a reset email whose link routes through the attacker's infrastructure, transmitting the one-time reset code upon the victim clicking it. Account takeover is achieved without requiring any credentials or prior access to the platform. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed; however, the technique is straightforward and the report originated from HackerOne, suggesting the attack vector is well-understood by researchers.
Bypass of Windows Driver Signature Enforcement in Veeam Backup and Replication 12.x and Software Appliance 13.x allows local administrators to load unsigned kernel drivers, potentially enabling persistent kernel-level compromise. The vulnerability requires high-level administrative privileges and is not actively exploited in the wild; however, EPSS scoring (0.01%) suggests this is a low-probability exploitation target despite the high CVSS score, indicating the attack scenario is constrained by strict privilege and configuration requirements.
Veeam allows Backup Operators to execute code as postgres via malicious interval or order parameters. Another operator-to-RCE escalation path with scope change.
Veeam allows Backup or Tape Operators to write files as root on the server. An operator-level role achieving root file write is a severe privilege escalation with scope change.
Command injection in Veeam Backup & Replication lets a Backup Administrator achieve remote code execution as the postgres OS user by supplying a malicious password parameter, earning a CVSS 3.1 base score of 9.1 (CWE-77). Exploitation is gated: it requires an authenticated account holding the privileged Backup Administrator role (PR:H) and does not need user interaction, but it is not reachable by an anonymous attacker, and the scope change (S:C) reflects the pivot from the backup application into the underlying PostgreSQL OS account. Threat signals are mixed rather than urgent - EPSS is only 0.11% (30th percentile) and no public exploit code has been identified at time of analysis, though the high privilege associated with the backup-admin role and the OS-level impact make this a serious issue for defenders to close via the vendor's KB4792 guidance.
Remote code execution as root in Veeam Backup & Replication allows an authenticated Backup Operator or Tape Operator to run arbitrary OS commands on the Veeam host by crafting a malicious backup configuration file. The vendor scores this 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the description itself establishes a privileged-role prerequisite, and our independent assessment rates it AV:N/AC:L/PR:L (authenticated low-privilege), meaning exploitation is gated behind an already-delegated Backup or Tape Operator account rather than being available to any unauthenticated network attacker. No user interaction is required, EPSS is low at 0.07% (22nd percentile), and no public exploit code has been identified at time of analysis; the severe root-level impact makes this a high-value target wherever those operator roles are delegated to less-trusted users.
Privilege escalation vulnerability in backup management systems that permits authenticated users with the Backup Operator role to modify backup job configurations and execute arbitrary code with system privileges. The vulnerability affects backup software implementations that fail to properly validate backup job modifications; attackers must possess valid Backup Operator credentials but face no additional complexity once authenticated. This vulnerability is not currently listed in CISA's KEV catalog, but the high CVSS score of 7.2 and code execution capability indicate significant risk to organizations managing sensitive backup infrastructure.
Remote code execution vulnerability in Backup Server that allows authenticated domain users to execute arbitrary code with high severity (CVSS 8.8). The vulnerability requires valid domain credentials but no user interaction, making it a significant risk for organizations with Backup Server deployments in Active Directory environments. If actively exploited or with public POC availability, this represents an immediate priority for patching.
A vulnerability allowing remote code execution (RCE) for domain users. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 26.3%.
Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. Rated high severity (CVSS 7.0). No vendor patch available.
A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuration settings, such as modifying the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escalating privileges to system-level access. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent is installed. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An incorrect permission assignment vulnerability allows an attacker to modify product configuration files. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Veeam Backup Enterprise Manager allows account takeover via NTLM relay. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.