Read the docs
TI-2023-12256 Aliases CVE-2023-27532GHSA-hh3c-xpmg-w5fr

Missing authentication in Veeam Backup & Replication

Priority CRITICAL 90Exploited in the wildCWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-306.

Summary

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.

Why it matters now

Exploitation Active In CISA KEV since 2023-08-22CISA due date 2023-09-12Known ransomware use
EPSS 0.80599 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Veeam Backup & ReplicationFixed Versions: v12 (build 12.0.0.1420 P20230223); 11a (build 11.0.1.1261 P20230227)—No fix listedCNA
  • Veeam Backup & Replication Vendor— Affected Fixed Versions: v12 (build 12.0.0.1420 P20230223); 11a (build 11.0.1.1261 P20230227) Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*before 11.0.1.1261VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:-:*:*:*:*:*:*11.0.1.1261VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211123:*:*:*:*:*:*11.0.1.1261 p20211123VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211211:*:*:*:*:*:*11.0.1.1261 p20211211VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20220302:*:*:*:*:*:*11.0.1.1261 p20220302VulnerableVeeam
cpe:2.3:a:veeam:veeam_backup_\&_replication:12.0.0.1420:-:*:*:*:*:*:*12.0.0.1420VulnerableVeeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:* Versions before 11.0.1.1261 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:-:*:*:*:*:*:* Versions 11.0.1.1261 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211123:*:*:*:*:*:* Versions 11.0.1.1261 p20211123 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211211:*:*:*:*:*:* Versions 11.0.1.1261 p20211211 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20220302:*:*:*:*:*:* Versions 11.0.1.1261 p20220302 Vulnerable ·Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:12.0.0.1420:-:*:*:*:*:*:* Versions 12.0.0.1420 Vulnerable ·Veeam

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2023-08-22 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2023-27532
  3. 2026-10-03 Alias added: GHSA-hh3c-xpmg-w5fr

References

Advisory 1

  • TI-2024-27107 Deserialization of untrusted data in Veeam Backup and Recovery KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09844 Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09843 Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and… KEVCVSS 3.1HIGH 8.8
  • TI-2024-19623 Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. CVSS 3.0CRITICAL 9.8
  • TI-2025-16913 A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user CVSS 3.1HIGH 8.8
  • TI-2025-16912 A vulnerability allowing remote code execution (RCE) for domain users. CVSS 3.1HIGH 8.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences