CVE-2022-26500
Veeam Backup & Replication Remote Code Execution Vulnerability
Published Mar 17, 2022 · updated Jun 16, 2026 · veeam veeam backup & replication
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Timeline
Detection, updates, and resolution for this record.
Mar 17, 2022 · Catalog
Detected
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Dec 13, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jan 3, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Required action
Apply updates per vendor instructions.
CISA due date Jan 3, 2023
Affected
- cpe veeam/veeam backup & replicationversion unspecified
- cpe veeam/veeam backup & replication10.0.1.4854
- cpe veeam/veeam backup & replication11.0.1.1261
- cpe veeam/veeam backup & replication9.5.0.1536
- cpe veeam/veeam backup & replication9.5.4.2615
- vendor Veeam Backup & Replicationversion unspecified
Sources
- CISA KEVCVE-2022-26500
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
cisa.gov - CVE.orgCVE-2022-26500
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-26500
30-day exploitation probability 5.8%
first.org - NIST NVDCVE-2022-26500
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
nvd.nist.gov