Vendor

Veeam

4 of 12 Veeam CVEs in Patchfirst (33%) are in of vulnerabilities exploited in the wild, 4 of them used by ransomware.

CVEs: 12
In CISA KEV: 433%
Known ransomware use: 4
Median days to KEV: 218; from publication
Latest KEV listing: 17 Oct 2024

Watch Veeam Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
Backup & Replication In KEV: 4 CVEs: 4
Backup and Replication In KEV: 0 CVEs: 4
Management Pack for Microsoft System Center In KEV: 0 CVEs: 1
ONE In KEV: 0 CVEs: 1
One Agent In KEV: 0 CVEs: 1
Service Provider Console In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with Veeam CVEs

TechniqueCVEs
T1190Exploit Public-Facing Application CVEs: 3
T1059Command and Scripting Interpreter CVEs: 3
T1036Masquerading CVEs: 2
T1048Exfiltration Over Alternative Protocol CVEs: 2
T1133External Remote Services CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/veeam.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are Veeam CVEs linked to the technique. Each link’s provenance is on the CVE page.

Veeam CVEs

12 CVEs, by priority

CVE-2023-27532Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability
Veeam · Backup & ReplicationKEVRansomwarePublic exploitHigh · 7.5T1133External Remote Services T1059.003Windows Command Shell+4 more · 1 report
80.6%Top 0.38%
82.0priority
CVE-2024-40711Veeam Backup and Replication Deserialization Vulnerability
Veeam · Backup & ReplicationKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
90.4%Top 0.2%
79.8priority
CVE-2024-42448From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is…
Veeam · Service Provider ConsolePublic exploitCritical · 9.9
20.4%Top 2.5%
76.4priority
CVE-2022-26501Veeam Backup & Replication Remote Code Execution Vulnerability
Veeam · Backup & ReplicationKEVRansomwareCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+2 more
4.1%Top 9.3%
73.0priority
CVE-2022-26500Veeam Backup & Replication Remote Code Execution Vulnerability
Veeam · Backup & ReplicationKEVRansomwareHigh · 8.8T1078Valid Accounts T1190Exploit Public-Facing Application+3 more
5.8%Top 6.9%
72.8priority
CVE-2026-44963A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user
Veeam · Backup and ReplicationPublic exploitCritical · 9.4
2.4%Top 16%
69.9priority
CVE-2026-32996This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation
Veeam · Backup and ReplicationPublic exploitHigh · 7.3
0.2%Top 94%
58.7priority
CVE-2020-10915This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent…
VEEAM · One AgentPublic exploitCritical · 9.8
86.6%Top 0.26%
31.8priority
CVE-2025-64393This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the…
Veeam · Backup and ReplicationCritical · 9.4
5.2%Top 7.5%
27.3priority
CVE-2020-15419This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE…
Veeam · ONEHigh · 7.5
59.8%Top 0.87%
25.1priority
CVE-2023-22793A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the…
Veeam · Management Pack for Microsoft System CenterCritical · 9.3
0.5%Top 55%
16.1priority
CVE-2026-108142A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service
Veeam · Backup and ReplicationCritical · 9.1
0.4%Top 66%
14.3priority