Veeam vulnerabilities
We track 46 vulnerabilities in Veeam products across 27 products. 46 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on October 29, 2026.
Latest Veeam vulnerabilities
- 8.8 High severity
Management Pack for Microsoft System Center: Relative Path Traversal
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.
- 8.7 High severity
Management Pack for Microsoft System Center: Deserialization of Untrusted Data
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.
- 9.3 Critical severity
Management Pack for Microsoft System Center: Deserialization of Untrusted Data
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.
- 8.5 High severity
ONE: Authentication Bypass Using an Alternate Path or Channel
A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.
- 8.3 High severity
Backup for Microsoft 365: Incorrect Authorization
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
- 9.0 Critical severity
Backup for Microsoft 365: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as th
- 7.3 High severity
Agent for Linux: Untrusted Search Path
A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected.
- 8.7 High severity
ONE: Improper Authentication
A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.
- 9.5 Critical severity
Service Provider Console: Authentication Bypass Using an Alternate Path or Channel
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.
- 8.2 High severity
Service Provider Console: Missing Authentication for Critical Functionality
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins.
- 8.4 High severity
Backup and Replication: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system.
- 8.6 High severity
Backup and Replication: Absolute Path Traversal
A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.
- 9.1 Critical severity
Software Appliance: Improper Control of Generation of Code
A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.
- 9.0 Critical severity
Backup and Recovery: Improper Neutralization of Special Elements used in a Command
This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.
- 9.1 Critical severity
Backup and Recovery: Improper Neutralization of Special Elements used in a Command
This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.
- 9.9 Critical severity
Backup and Replication: Improper Access Control
A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.
- 7.8 High severity
Agent for Microsoft Windows: Improper Privilege Management
This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file.
- 9.0 Critical severity
Backup for AWS: Improper Certificate Validation
A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly validate TLS certificate.
- 7.2 High severity
Backup for Microsoft Azure: Server-Side Request Forgery
Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- 9.9 Critical severity
Service Provider Console: Improper Control of Generation of Code
From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.
- 7.0 High severity
Agent for Windows: Untrusted Search Path
DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. When the agent runs, it searches these directories for necessary DLLs. If an attacker places a malicious DLL in one of these directories, the Veeam Ag
- 8.8 High severity
Backup & Replication: Missing Authentication for Critical Functionality
A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuration settings, such as modifying the trusted client certificate used for authentication on a specific po
- 8.1 High severity
Backup & Replication: Missing Authentication for Critical Functionality
A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. This exploit allows the attacker to delete any file on the system
- 8.1 High severity
Backup & Replication: Missing Authorization
A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability to power off virtual machines, delete files in storage, and make configuration chan
- 8.8 High severity
Backup & Replication: Incorrect Authorization
A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escalating privileges to system-level access. This allows the attacker to upload files to the server with e
- 7.1 High severity
Service Provider Console: Incorrect Permission Assignment for Critical Resource
From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbitrary files on the VSPC server machine.
- 8.8 High severity
Backup & Replication: Missing Authentication for Critical Functionality
A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share a
- 7.7 High severity
Enterprise Manager: Authentication Bypass by Capture-replay
A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Attackers must be able to perform Man-in-the-Middle (MITM) attack to exploit this vulnerability.
- 8.8 High severity
One: Execution with Unnecessary Privileges
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent is installed.
- 8.0 High severity
One: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user interaction and data collected from Veeam Backup & Replication.
- 8.8 High severity
Nutanix AHV: Server-Side Request Forgery
A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vulnerability.
- 8.3 High severity
Backup and Recovery: Improper Certificate Validation
An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations.
- 7.8 High severity
Backup and Recovery: Improper Authentication
A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA.
- 7.8 High severity
Backup and Recovery: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE).
- 9.8 Critical severity
Veeam Backup and Replication Deserialization Exploited
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
- 8.8 High severity
Backup and Recovery: Insufficiently Protected Credentials
A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and passwords). Exploiting these vulnerabilities requires a user who has b
- 8.5 High severity
Veeam Service Provider Console: Improper Control of Generation of Code
A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server.
- 9.9 Critical severity
Veeam Service Provider Console: Improper Control of Generation of Code
A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server.
- 8.5 High severity
Veeam Service Provider Console: Improper Control of Generation of Code
A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server.
- 9.9 Critical severity
Service Provider Console: Deserialization of Untrusted Data
Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC serve