Vendor

Veeam

107 known vulnerabilities.

Veeam at a glance

Last 12 months: 50
Critical · all time: 35
Exploited · all time: 1
Public exploit · all time: 11

1 of the exploited vulnerabilities are known to be used by ransomware (CISA).

New vulnerabilities per month · last 2412 months

Show as table

Month	Vulnerabilities	Critical
Nov 2026	0	0
Oct 2026	18	4
Sep 2026	0	0
Aug 2026	13	4
Jul 2026	2	0
Jun 2026	1	1
May 2026	3	1
Apr 2026	1	0
Mar 2026	8	5
Feb 2026	0	0
Jan 2026	4	3
Dec 2025	0	0
Nov 2025	0	0
Oct 2025	3	1
Sep 2025	0	0
Aug 2025	0	0
Jul 2025	0	0
Jun 2025	3	1
May 2025	0	0
Apr 2025	0	0
Mar 2025	1	1
Feb 2025	1	1
Jan 2025	1	0
Dec 2024	12	1

Most common weaknesses

Products

One 21 Backup and Replication 21 Backup and Recovery 14 Backup & Replication 12 Service Provider Console 10 Veeam Service Provider Console 4 Agent for Windows 4 Backup for Microsoft 365 4 Management Pack for Microsoft System Center 3 Recovery Orchestrator 3 Backup for Microsoft Azure 2 Software Appliance 2 One Agent 2 Availability Orchestrator 2 Backup Enterprise Manager 1 Backup for AWS 1 Backup for Google Cloud 1 Backup for Nutanix AHV 1 Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization 1 Backup for Salesforce 1 Nutanix AHV 1 Nutanix KVM 1 Enterprise Manager 1 Backup for Microsoft Windows 1 Agent for Microsoft Windows 1 Disaster Recovery Orchestrator 1 Agent for Linux 1 Backup 0 Management Pack for System Center 0 agent 0 Backup & Replication < 11.0.1.1261 P20220302. 0 veeam_backup_\&_replication 0 ONE < 12.0.1.2591 0 ONE < 11.0.1.1880 0 ONE < 11.0.0.1379 0 Backup & Replication for Google Cloud 1.0 0 Backup & Replication for Google Cloud 3.0 0

Latest advisories

High max 9.8

WID-SEC-2026-4008 2 CVEs rev. 19

Linux Kernel: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder Root-Rechte zu erlangen.

Oracle Google Red Hat SUSE Veeam Linux

Nov 10, 2026
first Oct 15, 2026
High max 9.3

WID-SEC-2026-4249 3 CVEs

Veeam Management Pack for System Center: Mehrere Schwachstellen ermöglichen Codeausführung

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Veeam Management Pack for System Center ausnutzen, um beliebigen Programmcode, möglicherweise mit Adminrechten, auszuführen.

Veeam Windows

Oct 29, 2026
High max 9.1

WID-SEC-2026-4212 4 CVEs

Veeam Backup & Replication: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Veeam Backup & Replication ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.

Veeam

Oct 27, 2026
Medium max 8.5

WID-SEC-2026-4213 1 CVE

Veeam ONE: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Veeam ONE ausnutzen, um die Multi-Faktor-Authentifizierung zu umgehen.

Veeam Windows

Oct 27, 2026
High max 9.0

WID-SEC-2026-4217 4 CVEs

Veeam Backup für Microsoft 365: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Veeam Backup für Microsoft 365 ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder einen Denial-of-Service-…

Veeam Windows

Oct 27, 2026

All Critical High Medium Low Exploited only Public exploit

107 results · Feed

Critical 9.3

CVE-2023-22793

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veea…

Veeam Management Pack for Microsoft System Center

Oct 29, 2026
High 8.8

CVE-2026-107239

A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (…

Veeam Management Pack for Microsoft System Center

Oct 29, 2026
High 8.7

CVE-2026-107238

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account…

Veeam Management Pack for Microsoft System Center

Oct 29, 2026
Medium 4.3

CVE-2025-64394

A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the install…

Veeam Backup for Microsoft 365

Oct 27, 2026
Medium 5.9

CVE-2026-108140

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a back…

Veeam Backup and Replication

Oct 27, 2026
Critical 9.1

CVE-2026-108142

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

Veeam Backup and Replication

Oct 27, 2026
Medium 5.9

CVE-2026-108141

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a back…

Veeam Backup and Replication

Oct 27, 2026
Medium 6.9

CVE-2026-106078

A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token a…

Veeam Backup for Microsoft 365

Oct 27, 2026
Critical 9.0

CVE-2026-106076

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of t…

Veeam Backup for Microsoft 365

Oct 27, 2026
High 8.3

CVE-2026-106077

A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on t…

Veeam Backup for Microsoft 365

Oct 27, 2026
High 7.3

CVE-2026-105477

A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by …

Veeam Agent for Linux Linux

Oct 27, 2026
High 8.5

CVE-2026-107671

A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disa…

Veeam One

Oct 27, 2026
Medium 4.1

CVE-2025-64391

This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write file…

Veeam Agent for Windows Windows

Oct 7, 2026
Medium 4.8

CVE-2025-64392

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal u…

Veeam Backup Enterprise Manager

Oct 7, 2026
Medium 6.1

CVE-2026-93026

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and…

Veeam Backup and Replication

Oct 7, 2026
Medium 6.8

CVE-2026-58068

This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the s…

Veeam Agent for Windows Windows

Oct 7, 2026
High 8.3

CVE-2026-58069

This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files o…

Veeam Backup and Replication

Oct 7, 2026
Critical 9.4

CVE-2025-64393

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the back…

Veeam Backup and Replication

Oct 7, 2026
High 8.5

CVE-2026-64632

A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.

Veeam One

Aug 26, 2026
Medium 6.8

CVE-2026-58070

A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a use…

Veeam Backup and Replication

Aug 26, 2026
Critical 9.3

CVE-2026-65641

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.

Veeam One

Aug 26, 2026
Critical 10.0

CVE-2026-64633 Public exploit

A vulnerability allowing remote unauthenticated code execution on the agent host.

Veeam One

Aug 4, 2026
High 8.4

CVE-2026-64634

A vulnerability allowing local privilege escalation to the Reporter service context.

Veeam One

Aug 4, 2026
High 8.6

CVE-2026-64631

A vulnerability allowing a low-privileged user to inject SQL and extract database contents.

Veeam One

Aug 4, 2026
Medium 5.3

CVE-2026-64630

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.

Veeam One

Aug 4, 2026
Critical 9.0

CVE-2026-58072

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lea…

Veeam Service Provider Console

Aug 4, 2026
High 8.7

CVE-2026-58067

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause…

Veeam Service Provider Console

Aug 4, 2026
Critical 9.5

CVE-2026-58073 Public exploit

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent a…

Veeam Service Provider Console

Aug 4, 2026
High 8.2

CVE-2026-58071

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance …

Veeam Service Provider Console

Aug 4, 2026
High 8.6

CVE-2026-58074

A vulnerability allowing a high-privileged user to execute arbitrary code on the server.

Veeam One

Aug 4, 2026
High 8.7

CVE-2026-58075

A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further levera…

Veeam One

Aug 4, 2026
Medium 5.3

CVE-2026-64635

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows a…

Veeam Service Provider Console

Jul 30, 2026
High 8.4

CVE-2026-56844

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate…

Veeam Backup and Replication

Jul 22, 2026
Critical 9.4

CVE-2026-44963 Public exploit

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

Veeam Backup and Replication

Jun 9, 2026
Critical 9.4

CVE-2026-32998

This vulnerability in Veeam Service Provider Console allows for remote code execution.

Veeam Service Provider Console

May 28, 2026
High 7.3

CVE-2026-32996 Public exploit

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

Veeam Backup and Replication

May 28, 2026
High 8.6

CVE-2026-32997

A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-bas…

Veeam Backup and Replication

May 28, 2026
Medium 6.7

CVE-2026-21709

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.

Veeam Backup and Replication Software Appliance

Apr 17, 2026
Critical 9.9

CVE-2026-21708

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

Veeam Backup and Replication

Mar 12, 2026
High 8.8

CVE-2026-21672

A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.

Veeam Backup and Replication

Mar 12, 2026

Veeam

Veeam at a glance

Most common weaknesses

Products

Latest advisories

Linux Kernel: Mehrere Schwachstellen

Veeam Management Pack for System Center: Mehrere Schwachstellen ermöglichen Codeausführung

Veeam Backup & Replication: Mehrere Schwachstellen

Veeam ONE: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Veeam Backup für Microsoft 365: Mehrere Schwachstellen

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veea…

A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (…

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account…

A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the install…

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a back…

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a back…

A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token a…

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of t…

A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on t…

A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by …

A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disa…

This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write file…

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal u…

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and…

This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the s…

This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files o…

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the back…

A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.

A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a use…

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.

A vulnerability allowing remote unauthenticated code execution on the agent host.

A vulnerability allowing local privilege escalation to the Reporter service context.

A vulnerability allowing a low-privileged user to inject SQL and extract database contents.

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lea…

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause…

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent a…

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance …

A vulnerability allowing a high-privileged user to execute arbitrary code on the server.

A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further levera…

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows a…

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate…

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

This vulnerability in Veeam Service Provider Console allows for remote code execution.

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-bas…

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.