← Back

Veeam

veeam

71 CVEs • 14 products

Products (14)

Click to collapse
Toggle
Veeam Backup & Replication
veeam_backup_&_replication
42 CVEs
One
one
12 CVEs
One Reporter
one_reporter
3 CVEs
Recovery Orchestrator
recovery_orchestrator
3 CVEs
Veeam Agent For Windows
veeam_agent_for_windows
3 CVEs
One Firmware
one_firmware
2 CVEs
Veeam Service Provider Console
veeam_service_provider_console
2 CVEs
Veeam Availability Suite
veeam_availability_suite
1 CVE
Veeam
veeam
1 CVE
Management Pack
management_pack
1 CVE
Veeam Backup For Google Cloud
veeam_backup_for_google_cloud
1 CVE
Availability Orchestrator
availability_orchestrator
1 CVE
Disaster Recovery Orchestrator
disaster_recovery_orchestrator
1 CVE
Backup
backup
1 CVE

CVEs (71)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-39718
1Veeam
1Veeam Backup & Replication
Jun 17, 2026
Sep 7, 2024
N/A· v4
8.1 HIGH· v3
N/A· v2
An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account.
CVE-2024-29855
1Veeam
1Recovery Orchestrator
Jun 17, 2026
Jun 11, 2024
N/A· v4
9.0 CRITICAL· v3
N/A· v2
Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator
CVE-2024-29853
1Veeam
1Veeam Agent For Windows
Jun 17, 2026
May 22, 2024
N/A· v4
7.8 HIGH· v3
N/A· v2
An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation.
CVE-2024-29852
1Veeam
1Veeam Backup & Replication
Jun 17, 2026
May 22, 2024
N/A· v4
2.7 LOW· v3
N/A· v2
Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.
CVE-2024-29851
1Veeam
1Veeam Backup & Replication
Jun 17, 2026
May 22, 2024
N/A· v4
7.2 HIGH· v3
N/A· v2
Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.
CVE-2024-29850
1Veeam
1Veeam Backup & Replication
Jun 17, 2026
May 22, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
Veeam Backup Enterprise Manager allows account takeover via NTLM relay.
CVE-2024-29849
1Veeam
1Veeam Backup & Replication
Jun 17, 2026
May 22, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
CVE-2024-29212
1Veeam
1Veeam Service Provider Console
Jun 17, 2026
May 14, 2024
N/A· v4
9.9 CRITICAL· v3
N/A· v2
Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remo...Show more
Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.Show less
CVE-2024-22022
1Veeam
1Recovery Orchestrator
Jun 17, 2026
Feb 7, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator Server Service.
CVE-2024-22021
1Veeam
3Availability Orchestrator
Disaster Recovery OrchestratorRecovery Orchestrator
Jun 17, 2026
Feb 7, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to.
CVE-2023-41723
1Veeam
1One
Jun 17, 2026
Nov 7, 2023
N/A· v4
4.3 MEDIUM· v3
N/A· v2
A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of this vulnerability is reduced because the user with the Read-Only role is only ab...Show more
A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of this vulnerability is reduced because the user with the Read-Only role is only able to view the schedule and cannot make changes.Show less
CVE-2023-38549
1Veeam
1One
Jun 17, 2026
Nov 7, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Note: The criticality of th...Show more
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service. Note: The criticality of this vulnerability is reduced as it requires interaction by a user with the Veeam ONE Administrator role.Show less
CVE-2023-38548
1Veeam
1One
Jun 17, 2026
Nov 7, 2023
N/A· v4
4.3 MEDIUM· v3
N/A· v2
A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service.
CVE-2023-38547
1Veeam
1One
Jun 17, 2026
Nov 7, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL serve...Show more
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database.Show less
CVE-2023-27532
1Veeam
1Veeam Backup & Replication
Jun 17, 2026
Mar 10, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
CVE-2022-43549
1Veeam
1Veeam Backup For Google Cloud
Jun 17, 2026
Dec 5, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms.
CVE-2022-32225
1Veeam
1Management Pack
Jun 17, 2026
Jul 14, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0. This vulnerability could be exploited by an attacker by convincing a legitimate...Show more
A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0. This vulnerability could be exploited by an attacker by convincing a legitimate user to visit a crafted URL on a Veeam Management Pack for Microsoft System Center server, allowing for the execution of arbitrary scripts.Show less
CVE-2022-26504
1Veeam
1Veeam Backup & Replication
Jun 17, 2026
Mar 17, 2022
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManag...Show more
Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exeShow less
CVE-2022-26501
1Veeam
1Veeam Backup & Replication
Jun 17, 2026
Mar 17, 2022
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
CVE-2022-26500
1Veeam
1Veeam Backup & Replication
Jun 17, 2026
Mar 17, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.