CVE-2022-26501VulnerabilityPublished 12/13/2022Updated 10/24/2026
CVE-2022-26501: Veeam Backup & Replication Remote Code Execution Vulnerability
Affects Veeam Backup & ReplicationSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 12/13/2022
- KEV deadline
- 01/03/2023
- Ransomware
- Used in ransomware campaigns
- EPSS
- 4.1% chance of exploitation in 30 days – higher than 90% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.