ACTIVELY EXPLOITED
CVE-2022-26501: Veeam Backup & Replication Remote Code Execution Vulnerability
| Vendor | Veeam |
|---|---|
| Product | Backup & Replication |
| Actively exploited | Yes |
| Added to CISA KEV | 13 Dec 2022 |
| CISA federal deadline | 3 Jan 2023 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-306 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
SOURCES
Other Veeam flaws
- CVE-2024-40711: Veeam Backup and Replication Deserialization Vulnerability
- CVE-2023-27532: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability
- CVE-2022-26500: Veeam Backup & Replication Remote Code Execution Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.