Veeam Backup & Replication vulnerabilities
18 known vulnerabilities in Veeam Backup & Replication from Veeam. 18 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
Software Appliance: Improper Control of Generation of Code
A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.
- 9.0 Critical severity
Backup and Recovery: Improper Neutralization of Special Elements used in a Command
This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.
- 9.1 Critical severity
Backup and Recovery: Improper Neutralization of Special Elements used in a Command
This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.
- 9.9 Critical severity
Backup and Replication: Improper Access Control
A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.
- 8.8 High severity
Backup & Replication: Missing Authentication for Critical Functionality
A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuration settings, such as modifying the trusted client certificate used for authentication on a specific po
- 8.1 High severity
Backup & Replication: Missing Authentication for Critical Functionality
A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. This exploit allows the attacker to delete any file on the system
- 8.1 High severity
Backup & Replication: Missing Authorization
A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability to power off virtual machines, delete files in storage, and make configuration chan
- 8.8 High severity
Backup & Replication: Incorrect Authorization
A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escalating privileges to system-level access. This allows the attacker to upload files to the server with e
- 8.8 High severity
Backup & Replication: Missing Authentication for Critical Functionality
A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share a
- 7.7 High severity
Enterprise Manager: Authentication Bypass by Capture-replay
A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Attackers must be able to perform Man-in-the-Middle (MITM) attack to exploit this vulnerability.
- 8.3 High severity
Backup and Recovery: Improper Certificate Validation
An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations.
- 7.8 High severity
Backup and Recovery: Improper Authentication
A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA.
- 7.8 High severity
Backup and Recovery: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE).
- 9.8 Critical severity
Veeam Backup and Replication Deserialization Exploited
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
- 8.8 High severity
Backup and Recovery: Insufficiently Protected Credentials
A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and passwords). Exploiting these vulnerabilities requires a user who has b
- 8.8 High severity
Veeam Backup & Replication: Improper Authentication
Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe
- 9.8 Critical severity
Veeam Backup & Replication Remote Code Execution Exploited
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
- 8.8 High severity
Veeam Backup & Replication Remote Code Execution Exploited
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.