// For flags

CVE-2022-26501

Veeam Backup & Replication Remote Code Execution Vulnerability

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

Yes
*KEV

Decision

-
*SSVC
Descriptions

Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

Veeam Backup & Replication versiones 10.x y 11.x, presenta un Control de Acceso Incorrecto (problema 1 de 2)

The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-03-06 CVE Reserved
  • 2022-03-17 CVE Published
  • 2022-12-13 Exploited in Wild
  • 2023-01-03 KEV Due Date
  • 2024-08-03 CVE Updated
  • 2024-10-21 EPSS Updated
  • ---------- First Exploit
CWE
  • CWE-306: Missing Authentication for Critical Function
CAPEC
References (2)
URL Tag Source
URL Date SRC
URL Date SRC
URL Date SRC
https://veeam.com 2024-05-09
https://www.veeam.com/kb4288 2024-05-09
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Veeam
Search vendor "Veeam"
Veeam Backup \& Replication
Search vendor "Veeam" for product "Veeam Backup \& Replication"
>= 10.0.0.4442 < 10.0.1.4854
Search vendor "Veeam" for product "Veeam Backup \& Replication" and version " >= 10.0.0.4442 < 10.0.1.4854"
-
Affected
Veeam
Search vendor "Veeam"
Veeam Backup \& Replication
Search vendor "Veeam" for product "Veeam Backup \& Replication"
>= 11.0.0.825 < 11.0.1.1261
Search vendor "Veeam" for product "Veeam Backup \& Replication" and version " >= 11.0.0.825 < 11.0.1.1261"
-
Affected
Veeam
Search vendor "Veeam"
Veeam Backup \& Replication
Search vendor "Veeam" for product "Veeam Backup \& Replication"
10.0.1.4854
Search vendor "Veeam" for product "Veeam Backup \& Replication" and version "10.0.1.4854"
-
Affected
Veeam
Search vendor "Veeam"
Veeam Backup \& Replication
Search vendor "Veeam" for product "Veeam Backup \& Replication"
10.0.1.4854
Search vendor "Veeam" for product "Veeam Backup \& Replication" and version "10.0.1.4854"
p20201202
Affected
Veeam
Search vendor "Veeam"
Veeam Backup \& Replication
Search vendor "Veeam" for product "Veeam Backup \& Replication"
10.0.1.4854
Search vendor "Veeam" for product "Veeam Backup \& Replication" and version "10.0.1.4854"
p20210609
Affected
Veeam
Search vendor "Veeam"
Veeam Backup \& Replication
Search vendor "Veeam" for product "Veeam Backup \& Replication"
11.0.1.1261
Search vendor "Veeam" for product "Veeam Backup \& Replication" and version "11.0.1.1261"
-
Affected
Veeam
Search vendor "Veeam"
Veeam Backup \& Replication
Search vendor "Veeam" for product "Veeam Backup \& Replication"
11.0.1.1261
Search vendor "Veeam" for product "Veeam Backup \& Replication" and version "11.0.1.1261"
p20211123
Affected
Veeam
Search vendor "Veeam"
Veeam Backup \& Replication
Search vendor "Veeam" for product "Veeam Backup \& Replication"
11.0.1.1261
Search vendor "Veeam" for product "Veeam Backup \& Replication" and version "11.0.1.1261"
p20211211
Affected