ZeroDay Findings
Sign inSign up

Findings

CVE-2022-26500

Veeam Backup & Replication Remote Code Execution Vulnerability

Published Mar 17, 2022 · updated Jun 16, 2026 · veeam veeam backup & replication

The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 17, 2022 · Catalog

    Detected

    The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

  2. Dec 13, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jan 3, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

Required action

Apply updates per vendor instructions.

CISA due date Jan 3, 2023

Affected

  • cpe veeam/veeam backup & replicationversion unspecified
  • cpe veeam/veeam backup & replication10.0.1.4854
  • cpe veeam/veeam backup & replication11.0.1.1261
  • cpe veeam/veeam backup & replication9.5.0.1536
  • cpe veeam/veeam backup & replication9.5.4.2615
  • vendor Veeam Backup & Replicationversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2022-26500

    The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2022-26500

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2022-26500

    30-day exploitation probability 5.8%

    first.org
  • NIST NVDVulnerability recordCVE-2022-26500

    Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.

    nvd.nist.gov

References