Critical vulnerabilities found in Veeam Backup & Replication

IT administrators using Veeam’s Backup & Replication solution are being urged to immediately apply patches after the discovery of critical vulnerabilities.

“Multiple vulnerabilities (CVE-2022-26500, CVE-2022-26501) in Veeam Backup & Replication allow executing malicious code remotely without authentication,” Veeam warned in an alert over the weekend. “This may lead to gaining control over the target system.”

The Veeam Distribution Service (TCP 9380 by default) allows unauthenticated users to access internal API functions, the alert explained. “A remote attacker may send input to the internal API which may lead to uploading and executing of malicious code.”

These CVEs affect all versions from (4b) to P20211211. The patches are for versions 10a and 11a. If you are running any Veeam Backup & Replication version between 9.5 U4b ( and 11 ( P20210525), you must upgrade to version 11a P20220302.

The only safe version of Veeam Backup and Replication (in regards to the CVEs disclosed, that is) is P20220302.

Veeam added the following details:

  • the patch must be installed on the Veeam Backup & Replication server. Managed servers with Veeam Distribution Service will be updated automatically after installing the patch;
  • all new deployments of Veeam Backup & Replication version 11 and 10 installed using the ISO images dated 20220302 or later are not vulnerable;
  • admins using Veeam Backup & Replication 9.5, must upgrade to a supported product version;
  • admins that have to temporarily mitigate the vulnerabilities need to disable the Veeam Distribution Service. The Veeam Distribution Service is installed on the Veeam Backup & Replication server and servers specified as distribution servers in Protection Groups.

In addition to closing the door on these two vulnerabilities, the patches also fix two other problems:

  • A bug in Veeam Backup PS Manager (CVE-2022-26504). It allows authentication using non-administrative domain credentials. A remote attacker may use the vulnerable component to execute arbitrary code, the company said.
    Note that the default Veeam Backup & Replication installation is not vulnerable to this issue. Only Veeam Backup & Replication installations with an SCVMM server registered are vulnerable;
  • and one in Veeam Agent for Microsoft Windows (CVE-2022-26503). Veeam Agent for Windows uses Microsoft .NET data serialization mechanisms, the company explained. A local user may send malicious code to the network port opened by Veeam Agent for Windows Service (TCP 9395 by default), which will not be deserialized properly.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times. I can be reached at hsolomon [@]

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now