Read the docs

Veeam

Records120All Threatist records
Exploited (KEV)4In CISA KEV
CVSS critical34CVSS 9.0–10.0
CVSS high57CVSS 7.0–8.9

Exploited now

Veeam records in CISA KEV
TI-2024-27107 Veeam Backup and Replication Deserialization Vulnerability Priority CRITICAL 100KEV 2024-10-17TI-2023-12256 Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability Priority CRITICAL 90KEV 2023-08-22TI-2022-09843 Veeam Backup & Replication Remote Code Execution Vulnerability Priority CRITICAL 97KEV 2022-12-13TI-2022-09844 Veeam Backup & Replication Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2022-12-13

Components

Products in the NVD configurations · select one to filter the records
Veeam Backup & Replication 42 records CRITICAL One 12 records HIGH One Reporter 3 records MEDIUM Recovery Orchestrator 3 records MEDIUM Veeam Agent For Windows 3 records LOW One Firmware 2 records HIGH Veeam Service Provider Console 2 records MEDIUM Availability Orchestrator 1 record LOW

Records

120 records

TI-2024-27107 CVE-2024-40711 · GHSA-c76v-gjqc-j462

Deserialization of untrusted data in Veeam Backup and Recovery

Priority CRITICAL 100KEV

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.90369 Published 2024-09-07 No fix listed CWE-502
TI-2022-09843 CVE-2022-26500 · GHSA-2vw2-587w-g9v6

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and…

Priority CRITICAL 97KEV

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05828 Published 2022-03-17 No fix listed CWE-22
TI-2023-12256 CVE-2023-27532 · GHSA-hh3c-xpmg-w5fr

Missing authentication in Veeam Backup & Replication

Priority CRITICAL 90KEV

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.80599 Published 2023-03-10 No fix listed CWE-306
TI-2020-08796 CVE-2020-10915 · GHSA-8h5c-9h59-x8hw

Deserialization of untrusted data in Veeam One Agent

Priority HIGH 84

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.86734 Published 2020-04-22 No fix listed CWE-502
TI-2020-08795 CVE-2020-10914 · GHSA-jqjc-5vjm-rwq5

Deserialization of untrusted data in Veeam One Agent

Priority HIGH 72

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.47868 Published 2020-04-22 No fix listed CWE-502
TI-2020-12154 CVE-2020-15419 · GHSA-jg82-cxv9-53p9

XML external entity injection in Veeam ONE

Priority HIGH 67

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.59786 Published 2020-07-28 No fix listed CWE-611
TI-2024-28417 CVE-2024-42448 · GHSA-w4gc-9x8j-9hjv

Code injection in Veeam Service Provider Console

Priority MEDIUM 62

From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.

CVSS 3.0CRITICAL 9.9 Network Low privileges No interaction EPSS 0.20359 Published 2024-12-11 No fix listed CWE-94
TI-2023-19924 CVE-2023-38547 · GHSA-f346-p877-7wqq

Information disclosure in Veeam One

Priority MEDIUM 62

A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.2067 Published 2023-11-07 No fix listed CWE-200
TI-2025-18033 CVE-2025-24286 · GHSA-qppv-c8jg-w628

Improper privilege management in Veeam Backup and Recovery

Priority MEDIUM 52

A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.19071 Published 2025-06-18 No fix listed CWE-269
TI-2025-43885 CVE-2025-64393 · GHSA-6m95-66x2-x5hx

Veeam Backup & Replication flaw lets viewers run code as SYSTEM

Priority MEDIUM 51

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.05199 Published 2026-10-07 Fixed in 12.3.2.4934 CWE-502
TI-2024-28423 CVE-2024-42455 · GHSA-hw3m-2wrm-879c

Missing authentication in Veeam Backup & Replication

Priority MEDIUM 51

A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.15775 Published 2024-12-04 No fix listed CWE-306
TI-2022-21329 CVE-2022-43549 · GHSA-xqhh-f594-fg34

Improper authentication in Veeam Backup for Google Cloud

Priority MEDIUM 50

Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00773 Published 2022-12-05 No fix listed CWE-287
TI-2023-30893 CVE-2023-22793 · GHSA-6762-qxrg-r3x8

Remote code execution in Veeam Virtualization Extensions service

Priority MEDIUM 49

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00526 Published 2026-10-29 Fixed in 13.1.0.334 CWE-502
TI-2026-41826 CVE-2026-58075 · GHSA-v52p-jj97-4668

Improper authentication in Veeam ONE

Priority MEDIUM 46

A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00419 Published 2026-08-04 No fix listed CWE-287
Load more
Open these records in search →