Vendor

Veeam

107 known vulnerabilities.

Products

One 21 Backup and Replication 21 Backup and Recovery 14 Backup & Replication 12 Service Provider Console 10 Veeam Service Provider Console 4 Agent for Windows 4 Backup for Microsoft 365 4 Management Pack for Microsoft System Center 3 Recovery Orchestrator 3 Backup for Microsoft Azure 2 Software Appliance 2 One Agent 2 Availability Orchestrator 2 Backup Enterprise Manager 1 Backup for AWS 1 Backup for Google Cloud 1 Backup for Nutanix AHV 1 Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization 1 Backup for Salesforce 1 Nutanix AHV 1 Nutanix KVM 1 Enterprise Manager 1 Backup for Microsoft Windows 1 Agent for Microsoft Windows 1 Disaster Recovery Orchestrator 1 Agent for Linux 1 Backup 0 Management Pack for System Center 0 agent 0 Backup & Replication < 11.0.1.1261 P20220302. 0 veeam_backup_\&_replication 0 ONE < 12.0.1.2591 0 ONE < 11.0.1.1880 0 ONE < 11.0.0.1379 0 Backup & Replication for Google Cloud 1.0 0 Backup & Replication for Google Cloud 3.0 0

All Critical High Medium Low Exploited only Public exploit

35 results · Clear filters · Feed

Critical 9.3

CVE-2023-22793

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veea…

Veeam Management Pack for Microsoft System Center

Oct 29, 2026
Critical 9.1

CVE-2026-108142

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

Veeam Backup and Replication

Oct 27, 2026
Critical 9.0

CVE-2026-106076

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of t…

Veeam Backup for Microsoft 365

Oct 27, 2026
Critical 9.4

CVE-2025-64393

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the back…

Veeam Backup and Replication

Oct 7, 2026
Critical 9.3

CVE-2026-65641

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.

Veeam One

Aug 26, 2026
Critical 10.0

CVE-2026-64633 Public exploit

A vulnerability allowing remote unauthenticated code execution on the agent host.

Veeam One

Aug 4, 2026
Critical 9.0

CVE-2026-58072

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lea…

Veeam Service Provider Console

Aug 4, 2026
Critical 9.5

CVE-2026-58073 Public exploit

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent a…

Veeam Service Provider Console

Aug 4, 2026
Critical 9.4

CVE-2026-44963 Public exploit

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

Veeam Backup and Replication

Jun 9, 2026
Critical 9.4

CVE-2026-32998

This vulnerability in Veeam Service Provider Console allows for remote code execution.

Veeam Service Provider Console

May 28, 2026
Critical 9.9

CVE-2026-21708

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

Veeam Backup and Replication

Mar 12, 2026
Critical 10.0

CVE-2026-21669

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

Veeam Backup and Replication

Mar 12, 2026
Critical 10.0

CVE-2026-21666

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

Veeam Backup and Replication

Mar 12, 2026
Critical 10.0

CVE-2026-21667

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

Veeam Backup and Replication

Mar 12, 2026
Critical 9.1

CVE-2026-21671

A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE…

Veeam Software Appliance

Mar 12, 2026
Critical 9.0

CVE-2025-59468

This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending…

Veeam Backup and Recovery

Jan 8, 2026
Critical 9.0

CVE-2025-59469

This vulnerability allows a Backup or Tape Operator to write files as root.

Veeam Backup and Recovery

Jan 8, 2026
Critical 9.0

CVE-2025-59470 Public exploit

This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a ma…

Veeam Backup and Recovery

Jan 8, 2026
Critical 10.0

CVE-2025-48983

A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the…

Veeam Backup and Replication

Oct 30, 2025
Critical 9.9

CVE-2025-23121 EPSS 26%

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user

Veeam Backup and Recovery

Jun 18, 2025
Critical 9.9

CVE-2025-23120 EPSS 24%

A vulnerability allowing remote code execution (RCE) for domain users.

Veeam Backup and Recovery

Mar 20, 2025
Critical 9.0

CVE-2025-23114

A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected…

Veeam Backup for Microsoft Azure Backup for AWS Backup for Google Cloud Linux

Feb 5, 2025
Critical 9.9

CVE-2024-42448 Public exploit EPSS 20%

From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is po…

Veeam Service Provider Console

Dec 11, 2024
Critical 9.9

CVE-2024-39714

A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to r…

Veeam Veeam Service Provider Console

Sep 7, 2024
Critical 9.9

CVE-2024-38650

An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account o…

Veeam Veeam Service Provider Console

Sep 7, 2024
Critical 9.8

CVE-2024-40711 Exploited · Ransomware Public exploit Scanner template EPSS 90%

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exe…

Veeam Backup and Recovery

Sep 7, 2024
KEV Oct 17, 2024
Critical 9.1

CVE-2024-42024

A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform rem…

Veeam One

Sep 7, 2024
Critical 9.0

CVE-2024-42019

A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This att…

Veeam One

Sep 7, 2024
Critical 9.0

CVE-2024-29855 Public exploit EPSS 22%

Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator

Veeam Recovery Orchestrator

Jun 11, 2024
Critical 9.8

CVE-2024-29849 Public exploit EPSS 39%

Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.

Veeam Backup & Replication

May 22, 2024
Critical 9.9

CVE-2024-29212

Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication betwe…

Veeam Service Provider Console

May 13, 2024
Critical 9.8

CVE-2023-38548 EPSS 12%

A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acqu…

Veeam One

Nov 7, 2023
Critical 9.9

CVE-2023-38547 EPSS 21%

A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam O…

Veeam One

Nov 7, 2023
Critical 9.8

CVE-2020-10915 Public exploit EPSS 87%

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4…

Veeam One Agent

Apr 22, 2020
Critical 9.8

CVE-2020-10914 Public exploit EPSS 48%

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4…

Veeam One Agent

Apr 22, 2020

Veeam

Products

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veea…

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of t…

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the back…

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.

A vulnerability allowing remote unauthenticated code execution on the agent host.

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lea…

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent a…

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

This vulnerability in Veeam Service Provider Console allows for remote code execution.

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE…

This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending…

This vulnerability allows a Backup or Tape Operator to write files as root.

This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a ma…

A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the…

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user

A vulnerability allowing remote code execution (RCE) for domain users.

A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected…

From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is po…

A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to r…

An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account o…

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exe…

A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform rem…

A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This att…

Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator

Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.

Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication betwe…

A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acqu…

A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam O…

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4…

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4…