Veeam vulnerabilities
We track 46 vulnerabilities in Veeam products across 27 products. 46 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on October 29, 2026.
Latest Veeam vulnerabilities
- 8.8 High severity
Recovery Orchestrator: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator Server Service.
- 9.8 Critical severity
One: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration da
- 8.8 High severity
Veeam Backup & Replication: Improper Authentication
Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe
- 9.8 Critical severity
Veeam Backup & Replication Remote Code Execution Exploited
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
- 8.8 High severity
Veeam Backup & Replication Remote Code Execution Exploited
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
- 7.8 High severity
Veeam: Deserialization of Untrusted Data
Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to run arbitrary code with local system privileges.