Veeam Veeam provides backup, recovery, security software products

Known Exploited Veeam Vulnerabilities

The following Veeam vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 48 vulnerabilities in Veeam with an average score of 8.0 out of ten. Last year, in 2025 Veeam had 7 security vulnerabilities published. That is, 41 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.26

Recent Veeam Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2023-22793	Oct 29, 2026	Unauthenticated RCE in Veeam Virtualization Extensions Service A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.
CVE-2026-108142	Oct 27, 2026	A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
CVE-2026-108140	Oct 27, 2026	A vulnerability allowing an authenticated user with the Restore Operator role A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.
CVE-2026-106077	Oct 27, 2026	A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges. A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
CVE-2026-106076	Oct 27, 2026	A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
CVE-2026-105477	Oct 27, 2026	A vulnerability in Veeam Agent for Linux allows for local privilege escalation A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected.
CVE-2026-108141	Oct 27, 2026	A vulnerability allowing an authenticated user with the Restore Operator role A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.
CVE-2026-107671	Oct 27, 2026	A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification. A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.	One
CVE-2026-106078	Oct 27, 2026	A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
CVE-2025-64394	Oct 27, 2026	Veeam Backup for M365: Local Priv Escalation via Installer File Write A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.
CVE-2025-64391	Oct 07, 2026	Veeam Agent for MS Windows: Low-Priv User Can Write Arbitrary Files This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.
CVE-2025-64392	Oct 07, 2026	Veeam Backup Enterprise Manager XSS allows arbitrary script via crafted link This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.
CVE-2026-93026	Oct 07, 2026	Veeam Backup: Backup Viewer Can Alter Enterprise Manager Master Key This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.
CVE-2026-58068	Oct 07, 2026	Veeam Agent Windows Local Process Termination CVE-2026-58068 This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.
CVE-2026-58069	Oct 07, 2026	Veeam Backup & Replication Cloud Connect Authenticated File Read This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.
CVE-2025-64393	Oct 07, 2026	Arbitrary Code Execution via Backup Viewer in Veeam Backup & Replication This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
CVE-2026-65641	Aug 26, 2026	SMB Auth Coercion in Microsoft Windows SMB A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.	One
CVE-2026-64632	Aug 26, 2026	NTLM Credential Capture via Reporter Service Account (Windows) A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.	One
CVE-2026-58070	Aug 26, 2026	Cleartext Guest OS Credentials Logged in Support Log A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials.
CVE-2026-58073	Aug 04, 2026	Veeam Service Provider Console VSPC Auth Bypass: Air Gap Agent Impersonation A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials.
CVE-2026-58072	Aug 04, 2026	Veeam SPC: Remote Code Exec via Arbitrary File Write A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution.
CVE-2026-58074	Aug 04, 2026	High-Priv Exec by High-Privileged User (CVE202658074) A vulnerability allowing a high-privileged user to execute arbitrary code on the server.	One
CVE-2026-58075	Aug 04, 2026	Unauthenticated Local File Read & Priv Escalation via Host File Access A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.	One
CVE-2026-64631	Aug 04, 2026	Low-Privileged User SQLi Enables Data Extraction in Unknown Product A vulnerability allowing a low-privileged user to inject SQL and extract database contents.	One
CVE-2026-64633	Aug 04, 2026	Remote Unauthenticated Code Execution on Agent Host CVE-2026-64633 A vulnerability allowing remote unauthenticated code execution on the agent host.	One
CVE-2026-64630	Aug 04, 2026	Low-Privileged User Reads Report Data Beyond Shared Link Scope A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.	One
CVE-2026-64634	Aug 04, 2026	LPE via Reporter Service Context CVE-2026-64634 A vulnerability allowing local privilege escalation to the Reporter service context.	One
CVE-2026-58071	Aug 04, 2026	Veeam SPC: Unauth API Access Post-Login A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins.
CVE-2026-58067	Aug 04, 2026	Veeam Service Provider Console: Unauthenticated Memory Exhaustion DoS A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.
CVE-2026-64635	Jul 30, 2026	Unauth Redirect via returnUrl in Veeam Service Provider Console Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account.
CVE-2026-56844	Jul 22, 2026	LPE via Veeam Updater in Veeam Software Appliance A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system.
CVE-2026-44963	Jun 09, 2026	RCE via Authenticated Domain User on Backup Server A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.
CVE-2026-32998	May 28, 2026	Remote Code Execution (RCE) in Veeam Service Provider Console This vulnerability in Veeam Service Provider Console allows for remote code execution.
CVE-2026-32997	May 28, 2026	Veeam Backup & Replication: Authenticated Arbitrary File Write (Linux) A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.
CVE-2026-32996	May 28, 2026	Veeam Agent LPE in Windows Agent This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
CVE-2026-21709	Apr 17, 2026	Local Admin Bypass WDSE on Windows OS A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.
CVE-2026-21708	Mar 12, 2026	Backup Viewer RCE Exposes postgres User Privileges A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.
CVE-2026-21672	Mar 12, 2026	Veeam Backup & Replication Windows LPE A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.
CVE-2026-21666	Mar 12, 2026	Authenticated Domain User RCE on Backup Server A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
CVE-2026-21667	Mar 12, 2026	Remote Code Execution in Backup Server via Authenticated Domain User A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
CVE-2026-21668	Mar 12, 2026	Microsoft Windows Backup Repo: Authenticated Domain User Bypass File Manipulation A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.
CVE-2026-21670	Mar 12, 2026	Low-Privileged User Credential Extraction via SSH A vulnerability allowing a low-privileged user to extract saved SSH credentials.
CVE-2026-21671	Mar 12, 2026	Veeam Backup & Rep RCE via HA Authenticated Backup Admin A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.
CVE-2026-21669	Mar 12, 2026	Windows Backup Server: Auth. Domain RCE via Remote Code Exec A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
CVE-2025-59469	Jan 08, 2026	PrivEsc: Backup/Tape Operator Escalates to Root via File Write This vulnerability allows a Backup or Tape Operator to write files as root.
CVE-2025-55125	Jan 08, 2026	Root RCE via Malicious Backup Config in Veritas NetBackup This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file.
CVE-2025-59468	Jan 08, 2026	RCE via Malicious Password Param in PostgreSQL Backup Admin This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.
CVE-2025-59470	Jan 08, 2026	PostgreSQL RCE via Malicious Interval/Order This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.
CVE-2025-48983	Oct 30, 2025	Veeam Backup Mount Service RCE via Authenticated Domain User A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.
CVE-2025-48982	Oct 30, 2025	Local Priv Escalation in Veeam Agent for Windows via Malicious Restore This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file.