Read the docs
TI-2022-09846 Aliases CVE-2022-26504GHSA-cv53-q2q6-5cq9

Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x…

Priority MEDIUM 43CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe

Why it matters now

EPSS 0.02433 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*10.0.0.4442 to before 10.0.1.4854; 11.0.0.825 to before 11.0.1.1261VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:9.5.0.1536:*:*:*:*:*:*:*9.5.0.1536VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:9.5.4.2615:*:*:*:*:*:*:*9.5.4.2615VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:-:*:*:*:*:*:*10.0.1.4854VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20201202:*:*:*:*:*:*10.0.1.4854 p20201202VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20210609:*:*:*:*:*:*10.0.1.4854 p20210609VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20220304:*:*:*:*:*:*10.0.1.4854 p20220304VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:-:*:*:*:*:*:*11.0.1.1261VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211123:*:*:*:*:*:*11.0.1.1261 p20211123VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211211:*:*:*:*:*:*11.0.1.1261 p20211211VulnerableVeeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:* Versions 10.0.0.4442 to before 10.0.1.4854; 11.0.0.825 to before 11.0.1.1261 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:9.5.0.1536:*:*:*:*:*:*:* Versions 9.5.0.1536 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:9.5.4.2615:*:*:*:*:*:*:* Versions 9.5.4.2615 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:-:*:*:*:*:*:* Versions 10.0.1.4854 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20201202:*:*:*:*:*:* Versions 10.0.1.4854 p20201202 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20210609:*:*:*:*:*:* Versions 10.0.1.4854 p20210609 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20220304:*:*:*:*:*:* Versions 10.0.1.4854 p20220304 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:-:*:*:*:*:*:* Versions 11.0.1.1261 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211123:*:*:*:*:*:* Versions 11.0.1.1261 p20211123 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211211:*:*:*:*:*:* Versions 11.0.1.1261 p20211211 Vulnerable ·Veeam
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20220302:*:*:*:*:*:*11.0.1.1261 p20220302VulnerableVeeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20220302:*:*:*:*:*:* Versions 11.0.1.1261 p20220302 Vulnerable ·Veeam

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26504
  2. 2026-10-03 Alias added: GHSA-cv53-q2q6-5cq9

References

Advisory 2

  • TI-2024-27107 Deserialization of untrusted data in Veeam Backup and Recovery KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09844 Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09843 Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and… KEVCVSS 3.1HIGH 8.8
  • TI-2023-12256 Missing authentication in Veeam Backup & Replication KEVCVSS 3.1HIGH 7.5
  • TI-2024-19623 Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. CVSS 3.0CRITICAL 9.8
  • TI-2025-16913 A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user CVSS 3.1HIGH 8.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences