BR
Backup
Backup & Replication
On CISA KEVExploited in the wildRansomware-linked
56
CVEs
4
On KEV
9.9
Max CVSS
6
New 30D
Severity mix
Critical 15High 28Medium 11Low 1
Watch
Add Backup & Replication to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-40711 RansomwareIn wildKEV | 9.8 | Sep 7 | Veeam Backup and Replication Deserialization Vulnerability Affected: 12.0.0.1420 before 12.2.0.334 |
| CVE-2022-26501 RansomwareIn wildKEV | 9.8 | Mar 17 | Veeam Backup & Replication Remote Code Execution Vulnerability Affected: 10.0.0.4442 before 10.0.1.4854; 11.0.0.825 before 11.0.1.1261; 10.0.1.4854; 10.0.1.4854; 10.0.1.4854; 11.0.1.1261; +2 more |
| CVE-2022-26500 RansomwareIn wildKEV | 8.8 | Mar 17 | Veeam Backup & Replication Remote Code Execution Vulnerability Affected: 10.0.0.4442 before 10.0.1.4854; 11.0.0.825 before 11.0.1.1261; 9.5.0.1536; 9.5.4.2615; 10.0.1.4854; 10.0.1.4854; +4 more |
| CVE-2023-27532 RansomwareIn wildKEV | 7.5 | Mar 10 | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability Affected: Fixed Versions: v12 (build 12.0.0.1420 P20230223); 11a (build 11.0.1.1261 P20230227) |
| CVE-2026-21708 | 9.9 | Mar 12 | A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user Affected: 12 before 12.3.2; 13 before 13.0.1 |
| CVE-2026-21669 | 9.9 | Mar 12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server Affected: 13.0.1 before 13.0.1 |
| CVE-2025-48983 | 9.9 | Oct 31 | A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user Affected: 12.0.0.1402 before 12.3.2.4165 |
| CVE-2025-55125 | 9.8 | Jan 8 | This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file Affected: 13.0.0.4967 before 13.0.1.1071 |
| CVE-2024-29849 | 9.8 | May 22 | Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface Affected: before 12.1.2.172 |
| CVE-2021-35971 | 9.8 | Jun 30 | Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting Affected: 10.0 before 10.0.1.4854; 11.0 before 11.0.0.837 |
| CVE-2025-64393 | 9.4 | Oct 7 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server Affected: 12 before 12.3.2.4934 |
| CVE-2026-44963 | 9.4 | Jun 9 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user Affected: before 12.3.2 |
| CVE-2026-108142 New | 9.1 | Oct 27 | A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service Affected: 13.0 before 13.0.3; 13.1 before 13.1.2 |
| CVE-2026-21671 | 9.1 | Mar 12 | A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup &… Affected: 13.0.0.496 through 13.0.1.1071 |
| CVE-2025-59468 | 9.1 | Jan 8 | This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter Affected: 13.0.0.4967 before 13.0.1.1071 |
| CVE-2025-59469 | 9.0 | Jan 8 | This vulnerability allows a Backup or Tape Operator to write files as root Affected: 13.0.0.4967 before 13.0.1.1071 |
| CVE-2025-59470 | 9.0 | Jan 8 | This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter Affected: 13.0.0.4967 before 13.0.1.1071 |
| CVE-2026-21672 | 8.8 | Mar 12 | A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers Affected: 12 before 12.3.2; 13 before 13.0.1 |
| CVE-2026-21666 | 8.8 | Mar 12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server Affected: 12.3.2 before 12.3.2 |
| CVE-2026-21667 | 8.8 | Mar 12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server Affected: 12.0.0.1402 before 12.3.2.4465 |
| CVE-2025-48984 | 8.8 | Oct 31 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user Affected: 12.0.0.1402 before 12.3.2.4165 |
| CVE-2025-23121 | 8.8 | Jun 19 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user Affected: before 12.3.2.3617 |
| CVE-2025-23120 | 8.8 | Mar 20 | A vulnerability allowing remote code execution (RCE) for domain users Affected: 12.0.0.1402 before 12.3.1.1139 |
| CVE-2024-42456 | 8.8 | Dec 4 | A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuration settings, such as… Affected: 12.0.0.1402 before 12.3.0.310 |
| CVE-2024-42452 | 8.8 | Dec 4 | A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escalating privileges to… Affected: 12.0.0.1402 before 12.3.0.310 |
| CVE-2024-40717 | 8.8 | Dec 4 | A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs Affected: 12.0.0.1402 before 12.3.0.310 |
| CVE-2024-40710 | 8.8 | Sep 7 | A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information… Affected: before 12.2.0.334 |
| CVE-2024-29850 | 8.8 | May 22 | Veeam Backup Enterprise Manager allows account takeover via NTLM relay Affected: before 12.1.2.172 |
| CVE-2022-26504 | 8.8 | Mar 17 | Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers… Affected: 10.0.0.4442 before 10.0.1.4854; 11.0.0.825 before 11.0.1.1261; 9.5.0.1536; 9.5.4.2615; 10.0.1.4854; 10.0.1.4854; +6 more |
| CVE-2020-15518 | 8.8 | Jul 3 | VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control… Affected: before 10.0 |
| CVE-2026-32997 | 8.6 | May 28 | A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server Affected: 13 through 13.0.1 |
| CVE-2026-56844 | 8.4 | Jul 22 | A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the… Affected: All versions, or not specified |
| CVE-2026-58069 | 8.3 | Oct 7 | This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host Affected: 12 through 12.3.2; 13 through 13.0.3 |
| CVE-2024-40714 | 8.3 | Sep 7 | An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations Affected: before 12.2.0.334 |
| CVE-2024-42455 | 8.1 | Dec 4 | A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary… Affected: 12.0.0.1402 before 12.3.0.310 |
| CVE-2024-42453 | 8.1 | Dec 4 | A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts Affected: 12.0.0.1402 before 12.3.0.310 |
| CVE-2024-39718 | 8.1 | Sep 7 | An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account Affected: 12.0.0.1402 before 12.2.0.334 |
| CVE-2024-40713 | 7.8 | Sep 7 | A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA Affected: before 12.2.0.334 |
| CVE-2024-40712 | 7.8 | Sep 7 | A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE) Affected: before 12.2.0.334 |
| CVE-2024-40715 | 7.7 | Nov 7 | A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass Affected: before 12.2.0.334 |
| CVE-2026-32996 | 7.3 | May 28 | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation Affected: 13 through 13.0.1 |
| CVE-2025-23082 | 7.2 | Jan 14 | Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF) Affected: 7.0.0.467 before 7.1.0.59 |
| CVE-2024-29851 | 7.2 | May 22 | Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account Affected: before 12.1.2.172 |
| CVE-2026-58070 | 6.8 | Aug 26 | A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account… Affected: before 13.0.3 |
| CVE-2026-21709 | 6.7 | Apr 17 | A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement Affected: 12 before 12.3.2 |
| CVE-2026-21668 | 6.5 | Mar 12 | A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository Affected: 12.3.2 before 12.3.2 |
| CVE-2026-21670 | 6.5 | Mar 12 | A vulnerability allowing a low-privileged user to extract saved SSH credentials Affected: 13.0.1 before 13.0.1 |
| CVE-2024-42457 | 6.5 | Dec 4 | A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management… Affected: 12.0.0.1402 before 12.3.0.310 |
| CVE-2024-42451 | 6.5 | Dec 4 | A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext Affected: 12.0.0.1402 before 12.3.0.310 |
| CVE-2026-93026 | 6.1 | Oct 7 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials Affected: 12 before 12.3.2.4934 |