CVE-2022-26501
Veeam Backup & Replication Remote Code Execution Vulnerability
Published Mar 17, 2022 · updated Jun 16, 2026 · veeam veeam backup & replication
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Timeline
Detection, updates, and resolution for this record.
Mar 17, 2022 · Catalog
Detected
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Dec 13, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jan 3, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Required action
Apply updates per vendor instructions.
CISA due date Jan 3, 2023
Affected
- cpe veeam/veeam backup & replicationversion unspecified
- cpe veeam/veeam backup & replication10.0.1.4854
- cpe veeam/veeam backup & replication11.0.1.1261
- vendor Veeam Backup & Replicationversion unspecified
Sources
- CISA KEVCVE-2022-26501
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
cisa.gov - CVE.orgCVE-2022-26501
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-26501
30-day exploitation probability 4.1%
first.org - NIST NVDCVE-2022-26501
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
nvd.nist.gov