Veeam Veeam Backup & Replication vulnerabilities

CVE-2026-21708 Critical · 9.9 CWE-89 Mar 12, 2026

SQL Injection in Veeam Veeam Backup & Replication

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

CVE-2026-21671 Critical · 9.1 CWE-94 Mar 12, 2026

Code Injection in Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.

CVE-2026-21670 Medium · 6.5 CWE-522 Mar 12, 2026

Insufficiently Protected Credentials in Veeam Veeam Backup & Replication

A vulnerability allowing a low-privileged user to extract saved SSH credentials.

CVE-2026-21669 Critical · 9.9 CWE-94 Mar 12, 2026

Code Injection in Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

CVE-2026-21668 Medium · 6.5 CWE-862 Mar 12, 2026

Missing Authorization in Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.

CVE-2026-21667 High · 8.8 CWE-284 Mar 12, 2026

Improper Access Control in Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

CVE-2026-21666 High · 8.8 CWE-284 Mar 12, 2026

Improper Access Control in Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

CVE-2025-59470 Critical · 9.0 CWE-77 Jan 8, 2026

Command Injection in Veeam Veeam Backup & Replication

This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.

CVE-2025-59469 Critical · 9.0 CWE-200 Jan 8, 2026

Exposure of Sensitive Information in Veeam Veeam Backup & Replication

This vulnerability allows a Backup or Tape Operator to write files as root.

CVE-2025-59468 Critical · 9.1 CWE-77 Jan 8, 2026

Command Injection in Veeam Veeam Backup & Replication

This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.

CVE-2025-55125 Critical · 9.8 CWE-77 Jan 8, 2026

Command Injection in Veeam Veeam Backup & Replication

This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file.

CVE-2025-48984 High · 8.8 CWE-94 Oct 30, 2025

Code Injection in Veeam Veeam Backup & Replication

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

CVE-2025-48983 Critical · 9.9 CWE-284 Oct 30, 2025

Improper Access Control in Veeam Veeam Backup & Replication

A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.

CVE-2024-40711 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-502 Sep 7, 2024

Veeam Backup and Replication Deserialization Vulnerability

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

CVE-2023-27532 High · 7.5 KEV Urgent · 75 Public exploit Ransomware CWE-306 Mar 10, 2023

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.

CVE-2022-26501 Critical · 9.8 KEV Urgent · 72 Ransomware CWE-306 Mar 17, 2022

Veeam Backup & Replication Remote Code Execution Vulnerability

Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

CVE-2022-26500 High · 8.8 KEV High · 65 Ransomware CWE-22 Mar 17, 2022

Veeam Backup & Replication Remote Code Execution Vulnerability

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.