Vulnerabilidades do Veeam Veeam Backup & Replication

CVE-2026-21708 Crítica · 9.9 CWE-89 12/03/2026

SQL Injection em Veeam Veeam Backup & Replication

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

CVE-2026-21671 Crítica · 9.1 CWE-94 12/03/2026

Code Injection em Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.

CVE-2026-21670 Média · 6.5 CWE-522 12/03/2026

Insufficiently Protected Credentials em Veeam Veeam Backup & Replication

A vulnerability allowing a low-privileged user to extract saved SSH credentials.

CVE-2026-21669 Crítica · 9.9 CWE-94 12/03/2026

Code Injection em Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

CVE-2026-21668 Média · 6.5 CWE-862 12/03/2026

Missing Authorization em Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.

CVE-2026-21667 Alta · 8.8 CWE-284 12/03/2026

Improper Access Control em Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

CVE-2026-21666 Alta · 8.8 CWE-284 12/03/2026

Improper Access Control em Veeam Veeam Backup & Replication

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

CVE-2025-59470 Crítica · 9.0 CWE-77 08/01/2026

Command Injection em Veeam Veeam Backup & Replication

This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.

CVE-2025-59469 Crítica · 9.0 CWE-200 08/01/2026

Exposure of Sensitive Information em Veeam Veeam Backup & Replication

This vulnerability allows a Backup or Tape Operator to write files as root.

CVE-2025-59468 Crítica · 9.1 CWE-77 08/01/2026

Command Injection em Veeam Veeam Backup & Replication

This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.

CVE-2025-55125 Crítica · 9.8 CWE-77 08/01/2026

Command Injection em Veeam Veeam Backup & Replication

This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file.

CVE-2025-48984 Alta · 8.8 CWE-94 30/10/2025

Code Injection em Veeam Veeam Backup & Replication

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

CVE-2025-48983 Crítica · 9.9 CWE-284 30/10/2025

Improper Access Control em Veeam Veeam Backup & Replication

A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.

CVE-2024-40711 Crítica · 9.8 KEV Urgente · 83 Exploit público Ransomware CWE-502 07/09/2024

Veeam Backup and Replication Deserialization Vulnerability

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

CVE-2023-27532 Alta · 7.5 KEV Urgente · 75 Exploit público Ransomware CWE-306 10/03/2023

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.

CVE-2022-26501 Crítica · 9.8 KEV Urgente · 72 Ransomware CWE-306 17/03/2022

Veeam Backup & Replication Remote Code Execution Vulnerability

Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

CVE-2022-26500 Alta · 8.8 KEV Alta · 65 Ransomware CWE-22 17/03/2022

Veeam Backup & Replication Remote Code Execution Vulnerability

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.