Veeam vulnerabilities

CVE-2026-93026 Medium · 6.1 CWE-862 Oct 7, 2026

Missing Authorization in Veeam Backup and Replication

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.

CVE-2026-58069 High · 8.3 CWE-22 Oct 7, 2026

Path Traversal in Veeam Backup and Replication

This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.

CVE-2026-58068 Medium · 6.8 CWE-862 Oct 7, 2026

Missing Authorization in Veeam Veeam Agent For Windows

This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.

CVE-2025-64393 Critical · 9.4 CWE-502 Oct 7, 2026

Deserialization of Untrusted Data in Veeam Backup and Replication

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.

CVE-2025-64392 Medium · 4.8 CWE-79 Oct 7, 2026

Cross-site Scripting (XSS) in Veeam Backup Enterprise Manager

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.

CVE-2025-64391 Medium · 4.1 CWE-1386 Oct 7, 2026

This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local…

This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.

CVE-2026-56844 High · 8.4 CWE-22 Jul 21, 2026

Path Traversal in Veeam Backup and Replication

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system.

CVE-2026-44963 Critical · 9.4 CWE-502 Jun 9, 2026

Deserialization of Untrusted Data in Veeam Backup and Replication

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

CVE-2026-32998 Critical · 9.4 CWE-233 May 28, 2026

This vulnerability in Veeam Service Provider Console allows for remote code execution.

CVE-2026-32997 High · 8.6 CWE-36 May 28, 2026

A vulnerability allowing an authenticated user with the Backup Administrator role to…

A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.

CVE-2026-32996 High · 7.3 CWE-532 May 28, 2026

Insertion of Sensitive Information into Log File in Veeam Backup and Replication

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

CVE-2026-21709 Medium · 6.7 CWE-77 Apr 17, 2026

Command Injection in Veeam Backup and Replication

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.

CVE-2026-21708 Critical · 9.9 CWE-89 Mar 12, 2026

SQL Injection in Veeam Veeam Backup & Replication

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

CVE-2026-21672 High · 8.8 CWE-538 Mar 12, 2026

A vulnerability allowing local privilege escalation on Windows-based Veeam Backup &…

A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.

CVE-2026-21671 Critical · 9.1 CWE-94 Mar 12, 2026

Code Injection in Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.

CVE-2026-21670 Medium · 6.5 CWE-522 Mar 12, 2026

Insufficiently Protected Credentials in Veeam Veeam Backup & Replication

A vulnerability allowing a low-privileged user to extract saved SSH credentials.

CVE-2026-21669 Critical · 9.9 CWE-94 Mar 12, 2026

Code Injection in Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

CVE-2026-21668 Medium · 6.5 CWE-862 Mar 12, 2026

Missing Authorization in Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.

CVE-2026-21667 High · 8.8 CWE-284 Mar 12, 2026

Improper Access Control in Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

CVE-2026-21666 High · 8.8 CWE-284 Mar 12, 2026

Improper Access Control in Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

CVE-2025-59470 Critical · 9.0 CWE-77 Jan 8, 2026

Command Injection in Veeam Veeam Backup & Replication

This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.

CVE-2025-59469 Critical · 9.0 CWE-200 Jan 8, 2026

Exposure of Sensitive Information in Veeam Veeam Backup & Replication

This vulnerability allows a Backup or Tape Operator to write files as root.

CVE-2025-59468 Critical · 9.1 CWE-77 Jan 8, 2026

Command Injection in Veeam Veeam Backup & Replication

This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.

CVE-2025-55125 Critical · 9.8 CWE-77 Jan 8, 2026

Command Injection in Veeam Veeam Backup & Replication

This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file.

CVE-2025-48984 High · 8.8 CWE-94 Oct 30, 2025

Code Injection in Veeam Veeam Backup & Replication

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.