Veeam vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Veeam flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2024-40711 Veeam Backup and Replication DeserializationExploited since Oct 17, 2024 · ransomware · CVSS 9.8
• CVE-2023-27532 Veeam Backup & Replication Cloud Connect Missing Authentication for Critical FunctionExploited since Aug 22, 2023 · ransomware · CVSS 7.5
• CVE-2022-26501 Veeam Backup & Replication Remote Code ExecutionExploited since Dec 13, 2022 · ransomware · CVSS 9.8
• CVE-2022-26500 Veeam Backup & Replication Remote Code ExecutionExploited since Dec 13, 2022 · ransomware · CVSS 8.8

Latest high and critical flaws

• CVE-2026-108142 A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.Critical 9.1 · Oct 27, 2026
• CVE-2026-107671 A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA vHigh 8.5 · Oct 27, 2026
• CVE-2026-106077 A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileHigh 8.3 · Oct 27, 2026
• CVE-2026-106076 A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 Critical 9 · Oct 27, 2026
• CVE-2026-105477 A vulnerability in Veeam Agent for Linux allows for local privilege escalation.High 7.3 · Oct 27, 2026
• CVE-2026-58069 This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.High 8.3 · Oct 7, 2026
• CVE-2025-64393 This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.Critical 9.4 · Oct 7, 2026
• CVE-2026-65641 A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.Critical 9.3 · Aug 26, 2026
• CVE-2026-64632 A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.High 8.5 · Aug 26, 2026
• CVE-2026-64634 A vulnerability allowing local privilege escalation to the Reporter service context.High 8.4 · Aug 4, 2026
• CVE-2026-64633 A vulnerability allowing remote unauthenticated code execution on the agent host.Critical 10 · Aug 4, 2026
• CVE-2026-64631 A vulnerability allowing a low-privileged user to inject SQL and extract database contents.High 8.6 · Aug 4, 2026
• CVE-2026-58075 A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.High 8.7 · Aug 4, 2026
• CVE-2026-58074 A vulnerability allowing a high-privileged user to execute arbitrary code on the server.High 8.6 · Aug 4, 2026
• CVE-2026-58073 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.Critical 9.5 · Aug 4, 2026
• CVE-2026-58072 A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution.Critical 9 · Aug 4, 2026
• CVE-2026-58071 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a shortHigh 8.2 · Aug 4, 2026
• CVE-2026-58067 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.High 8.7 · Aug 4, 2026
• CVE-2026-56844 A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level accHigh 8.4 · Jul 21, 2026
• CVE-2026-44963 A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.Critical 9.4 · Jun 9, 2026
• CVE-2026-32998 This vulnerability in Veeam Service Provider Console allows for remote code execution.Critical 9.4 · May 28, 2026
• CVE-2026-32997 A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.High 8.6 · May 28, 2026
• CVE-2026-32996 This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.High 7.3 · May 28, 2026
• CVE-2026-21708 A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.Critical 9.9 · Mar 12, 2026
• CVE-2026-21672 A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.High 8.8 · Mar 12, 2026