CVE-2022-26500 · netVigilance record NV22-0548
Veeam Backup & Replication Remote Code Execution
past due ransomware
What to do
Apply updates per vendor instructions.
CISA deadline 2023-01-03 · passed 3 years 8 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA
What happened
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Who is affected
Veeam Backup & Replication. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.
Weakness class: CWE-22.
Timeline
- Added to CISA KEVExploitation in the wild confirmed by CISA
- CISA remediation deadlinepassed 3 years 8 months ago
Sources
- NVD entry for CVE-2022-26500 nvd.nist.gov/vuln/detail/CVE-2022-26500
- CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
- veeam.com www.veeam.com/kb4288
- nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2022-26500