Skip to content
OpenAdvisories
High · 8.8 CVE-2024-22022 EUVD-2024-19628GHSA-ccx2-385m-5g4m

Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash…

Published Feb 7, 2024 · Updated Jun 3, 2025 · Assigned by hackerone

Vendor: Veeam Product: Availability Orchestrator Product: Recovery Orchestrator

Description

Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator Server Service.

Affected products

VendorProductAffectedFixed
Veeam Recovery Orchestrator 6 – < 6, 5 – < 5 6
Veeam Availability Orchestrator 4 – < 4 4

References