Veeam
Vulnerability activity for Veeam: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 12
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 25
- Critical (CVSS 9+)
- 6
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 47
- Critical (CVSS 9+)
- 17
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 9.8CriticalSep 7, 2024Veeam Backup & Replication DeserializationCVE-2024-40711A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).Added to KEV Oct 17, 2024 · 39 days after publicationExploited90% likelyExploit codeNucleiDetection
- 7.5HighMar 10, 2023Veeam Backup & Replication Auth bypass / access controlCVE-2023-27532Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.Added to KEV Aug 22, 2023 · 165 days after publicationExploited81% likelyDetection
- 9.8CriticalMar 17, 2022Veeam Backup & Replication Auth bypass / access controlCVE-2022-26501The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.Added to KEV Dec 13, 2022 · 270 days after publicationExploited4.1% likely
- 8.8HighMar 17, 2022Veeam Backup & Replication Path traversal / file handlingCVE-2022-26500The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.Added to KEV Dec 13, 2022 · 270 days after publicationExploited5.8% likely
Recent
- –UnscoredOct 28, 2026VeeamADV-cccs-96ae07adb3f9Serial number: AV26-1096 Date: October 28, 2026 As of October 27, 2026, Veeam is affected by vulnerabilities in the following products: Veeam Agent for Linux Prior to 13.1.2 Veeam Backup and Replication Prior to 13.0.3 Prior to 13.1.2 Veeam Backup for Microsoft 365 Prior to or equal to 8.5.0.1014 Prior to or equal to 8.6.0.1102 Veeam ONE Prior to or equal to 13.1.0.7233 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they b
- 9.1CriticalOct 27, 2026Veeam Backup & ReplicationCVE-2026-108142A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
- 5.9MediumOct 27, 2026Veeam Backup & Replication Path traversal / file handlingCVE-2026-108141A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.
- 5.9MediumOct 27, 2026Veeam Backup & Replication Path traversal / file handlingCVE-2026-108140A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.
- 8.5HighOct 27, 2026Veeam ONE Auth bypass / access controlCVE-2026-107671A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.
- 7.3HighOct 27, 2026Veeam Backup & Replication Privilege escalationCVE-2026-105477A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected.
- 4.1MediumOct 7, 2026Veeam Agent for WindowsCVE-2025-64391This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.
- 4.8MediumOct 7, 2026Veeam Backup Enterprise Manager XSSCVE-2025-64392This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.
- 6.1MediumOct 7, 2026Veeam Backup and Replication Auth bypass / access controlCVE-2026-93026This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.
- 6.8MediumOct 7, 2026Veeam Agent for Windows Auth bypass / access controlCVE-2026-58068This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.
- 8.3HighOct 7, 2026Veeam Backup and Replication Path traversal / file handlingCVE-2026-58069This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.
- 9.4CriticalOct 7, 2026Veeam Backup and Replication DeserializationCVE-2025-64393This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.5.2% likely
- 8.5HighAug 26, 2026Veeam ONECVE-2026-64632A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.
- 6.8MediumAug 26, 2026Veeam Backup and Replication Information disclosureCVE-2026-58070A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials.
- 9.3CriticalAug 26, 2026Veeam One Auth bypass / access controlCVE-2026-65641A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.
- 8.4HighAug 4, 2026Veeam ONE Privilege escalationCVE-2026-64634A vulnerability allowing local privilege escalation to the Reporter service context.
- 10.0CriticalAug 4, 2026Veeam ONE Code / command injectionCVE-2026-64633A vulnerability allowing remote unauthenticated code execution on the agent host.
- 8.6HighAug 4, 2026Veeam ONE SQL injectionCVE-2026-64631A vulnerability allowing a low-privileged user to inject SQL and extract database contents.
- 5.3MediumAug 4, 2026Veeam ONE Auth bypass / access controlCVE-2026-64630A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.
- 8.7HighAug 4, 2026Veeam ONE Auth bypass / access controlCVE-2026-58075A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.
- 8.6HighAug 4, 2026Veeam ONE Code / command injectionCVE-2026-58074A vulnerability allowing a high-privileged user to execute arbitrary code on the server.
- 9.5CriticalAug 4, 2026Veeam Service Provider Console Auth bypass / access controlCVE-2026-58073A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.
- 9.0CriticalAug 4, 2026Veeam Service Provider Console Path traversal / file handlingCVE-2026-58072A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution.
- 8.2HighAug 4, 2026Veeam Service Provider Console Auth bypass / access controlCVE-2026-58071A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins.
- 8.7HighAug 4, 2026Veeam Service Provider Console Denial of serviceCVE-2026-58067A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.
- 5.3MediumJul 30, 2026Veeam Service Provider Console Auth bypass / access controlCVE-2026-64635Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an
- –UnscoredJul 14, 2026VeeamADV-veeam-7e49e1e790b0Veeam Software Appliance/Veeam Infrastructure Appliance — Updater Component Vulnerability
- 9.4CriticalJun 9, 2026Veeam Backup and Replication DeserializationCVE-2026-44963A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.2.4% likely
- 8.6HighMay 28, 2026Veeam Backup and Replication Path traversal / file handlingCVE-2026-32997A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.
- 7.3HighMay 28, 2026Veeam Backup and Replication Information disclosureCVE-2026-32996This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
- 9.4CriticalMay 28, 2026Veeam Service Provider Console Code / command injectionCVE-2026-32998This vulnerability in Veeam Service Provider Console allows for remote code execution.
- 6.7MediumApr 17, 2026Veeam Backup and Replication Code / command injectionCVE-2026-21709A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.
- 9.9CriticalMar 12, 2026Veeam Backup and Replication SQL injectionCVE-2026-21708A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.1.1% likely
- 8.8HighMar 12, 2026Veeam Backup and Replication Information disclosureCVE-2026-21672A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.
- 8.8HighMar 12, 2026Veeam Backup and Replication Path traversal / file handlingCVE-2026-21668A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.
- 10.0CriticalMar 12, 2026Veeam Backup and Replication Code / command injectionCVE-2026-21669A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.1.2% likely
- 9.1CriticalMar 12, 2026Veeam Software Appliance Code / command injectionCVE-2026-21671A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.1.4% likely
- 7.7HighMar 12, 2026Veeam Backup and ReplicationCVE-2026-21670A vulnerability allowing a low-privileged user to extract saved SSH credentials.
- 10.0CriticalMar 12, 2026Veeam Backup and Replication Auth bypass / access controlCVE-2026-21666A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.1.1% likely
- 10.0CriticalMar 12, 2026Veeam Backup and Replication Auth bypass / access controlCVE-2026-21667A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.1.1% likely
- 9.0CriticalJan 8, 2026Veeam Backup and Recovery Code / command injectionCVE-2025-59468This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.1.2% likely
- 7.8HighJan 8, 2026Veeam Backup And Recovery Code / command injectionCVE-2025-55125This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file.
- 9.0CriticalJan 8, 2026Veeam Backup and Recovery Information disclosureCVE-2025-59469This vulnerability allows a Backup or Tape Operator to write files as root.
- 9.0CriticalJan 8, 2026Veeam Backup and Recovery Code / command injectionCVE-2025-59470This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.1.5% likely
- 10.0CriticalOct 30, 2025Veeam Backup and Replication Auth bypass / access controlCVE-2025-48983A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.
- 7.3HighOct 30, 2025Veeam Agent for Microsoft Windows Privilege escalationCVE-2025-48982This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file.
- 8.8HighOct 30, 2025Veeam Backup and Replication Code / command injectionCVE-2025-48984A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.1% likely
- –UnscoredSep 3, 2025VeeamADV-veeam-a5a60570c889List of Security Fixes and Improvements in Veeam Plug-in for Nutanix AHV
- 7.2HighJun 18, 2025Veeam Backup and Recovery Privilege escalationCVE-2025-24286A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.19% likely
- 9.9CriticalJun 18, 2025Veeam Backup and Recovery Code / command injectionCVE-2025-23121A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user25% likely
Top products
- Backup and Replication17 CVEs in the last year, 7 critical
- ONE9 CVEs in the last year, 2 critical
- Service Provider Console6 CVEs in the last year, 3 critical
- Backup And Recovery4 CVEs in the last year, 3 critical
- Backup & Replication4 CVEs in the last year, 1 critical
- Agent for Windows2 CVEs in the last year
- Software Appliance1 CVE in the last year, 1 critical
- Backup Enterprise Manager1 CVE in the last year
- Agent for Microsoft Windows1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Oct 28, 2026Veeam security advisory (AV26-1096)ADV-cccs-96ae07adb3f9
- Veeam · Oct 27, 2026Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1CVE-2026-107671
- Veeam · Oct 27, 2026Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2CVE-2026-105477CVE-2026-108140CVE-2026-108141CVE-2026-108142
- CISA · Oct 20, 2026#StopRansomware: SafePay RansomwareCVE-2023-27532CVE-2024-40711
- Veeam · Oct 6, 2026List of Security Fixes and Improvements in Veeam Agent for Microsoft WindowsCVE-2022-26503CVE-2024-29853CVE-2024-45207CVE-2025-24287CVE-2025-48982CVE-2025-64391
- Veeam · Oct 6, 2026Vulnerabilities Resolved in Veeam Backup & Replication 13.1CVE-2025-64391CVE-2026-58068CVE-2026-58069CVE-2026-58070
- Veeam · Oct 6, 2026List of Security Fixes and Improvements in Veeam Backup & ReplicationCVE-2024-40717CVE-2025-23120CVE-2025-23121CVE-2025-24286CVE-2025-48983CVE-2025-48984
- Veeam · Oct 6, 2026Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4CVE-2025-64392CVE-2025-64393CVE-2026-93026
- Veeam · Aug 25, 2026Vulnerability Resolved in Veeam ONE 13.1 Patch 0CVE-2026-65641
- Veeam · Aug 25, 2026List of Security Fixes and Improvements in Veeam ONECVE-2026-58074CVE-2026-58075CVE-2026-64630CVE-2026-64631CVE-2026-64632CVE-2026-64633
- Veeam · Aug 25, 2026List of Security Fixes and Improvements in Veeam Agent for LinuxCVE-2024-40709
- Veeam · Aug 25, 2026Vulnerabilities Resolved in Veeam ONE 13.1CVE-2026-58074CVE-2026-58075CVE-2026-64630CVE-2026-64631CVE-2026-64632CVE-2026-64633
- Veeam · Aug 4, 2026List of Security Fixes and Improvements in Veeam Service Provider ConsoleCVE-2026-32998CVE-2026-58067CVE-2026-58071CVE-2026-58072CVE-2026-58073CVE-2026-64635
- Veeam · Aug 4, 2026Vulnerabilities Resolved in Veeam Service Provider Console 9.3CVE-2026-58067CVE-2026-58071CVE-2026-58072CVE-2026-58073
- Veeam · Jul 28, 2026Vulnerability Resolved in Veeam Service Provider Console 9.2.1CVE-2026-32998CVE-2026-64635
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.