{"id":"CVE-2023-27532","published":"2023-03-10T22:15:10Z","modified":"2026-06-17T05:45:24Z","title":"Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability","vendor":"Veeam","product":"Backup & Replication","tier":"core","eol":null,"description":{"text":"Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a missing authentication check in the Cloud Connect component of Veeam Backup & Replication, a Veeam product. It lets encrypted credentials stored in the configuration database be obtained, which can lead to access to backup infrastructure hosts. An attacker can exploit this over the network without authenticating, requiring no user interaction and no particular configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:26Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.80599,"percentile":0.99624,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-08-22","dueDate":"2023-09-12","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.veeam.com/kb4424;  https://nvd.nist.gov/vuln/detail/CVE-2023-27532","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-04-26","exploitedFirstSeen":"2023-04-26","ransomware":true,"evidence":[{"url":"https://labs.withsecure.com/publications/fin7-target-veeam-servers","date":"2023-04-26"},{"url":"https://thehackernews.com/2023/05/notorious-cyber-gang-fin7-returns-cl0p.html","date":"2023-05-22"},{"url":"https://blogs.blackberry.com/en/2023/08/cuba-ransomware-deploys-new-tools-targets-critical-infrastructure-sector-in-the-usa-and-it-integrator-in-latin-america","date":"2023-08-17"},{"url":"https://information.rapid7.com/rs/411-NAK-970/images/Rapid7-2023-Mid-Year-Threat-Review.pdf","date":"2023-08-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-08-22"},{"url":"https://blog.sekoia.io/sekoia-io-mid-2023-ransomware-threat-landscape","date":"2023-09-14"},{"url":"https://25491742.fs1.hubspotusercontent-eu1.net/hubfs/25491742/WAZAWAKA_TLPCLEAR_Report.pdf","date":"2023-12-20"},{"url":"https://news.sophos.com/en-us/2023/12/21/akira-again-the-ransomware-that-keeps-on-taking/","date":"2023-12-21"},{"url":"https://4502402.fs1.hubspotusercontent-na1.net/hubfs/4502402/Ransomware%202023%20Year%20in%20Review.pdf","date":"2024-01-24"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2024-0208.pdf","date":"2024-02-08"}],"evidenceTotal":61,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ae254acfd783d5b63290659","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257","url":"https://otx.alienvault.com/pulse/6ad9e23fd4fb55847c1a4d96","created":"2026-10-22"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ad8db024c84442cd0085496","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"cve-2026-0257","url":"https://otx.alienvault.com/pulse/6ad89300454bcf85fe5f154c","created":"2026-10-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://www.veeam.com/kb4424","tags":["Vendor Advisory"]},{"url":"https://www.veeam.com/kb4424","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27532","tags":["US Government Resource"]}],"techniques":[{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Missing Authentication","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. ","confidence":"high"},{"id":"T1059.003","name":"Windows Command Shell","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Missing Authentication","mappingType":"primary_impact","evidence":[],"comment":"CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. ","confidence":"high"},{"id":"T1087","name":"Account Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Missing Authentication","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. ","confidence":"high"},{"id":"T1087.001","name":"Local Account","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Missing Authentication","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. ","confidence":"high"},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Missing Authentication","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. ","confidence":"high"},{"id":"T1555","name":"Credentials from Password Stores","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Missing Authentication","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-27532 is a vulnerability in their backup & replication servers exposed online which allows unauthenticated users to request encrypted credentials. Public reporting has indicated that various ransomware groups have exploited vulnerability to gain access and crash the backup infrastructure hosts, extract stored encrypted credentials, and deploy additional tools. ","confidence":"high"}],"reports":[{"id":"SRC-b512cebcaeab0c4108dc","title":"Qilin Ransomware Analysis: Critical TTPs and Defense","publisher":"picussecurity.com","url":"https://www.picussecurity.com/resource/blog/qilin-ransomware","date":null,"mentions":[{"quote":"Exploited CVE: CVE-2023-27532","start":2275,"end":2304},{"quote":"A pertinent example is the exploitation of the CVE-2023-27532 vulnerability in Veeam Backup & Replication software.","start":2849,"end":2964},{"quote":"There are publicly available proofs of concept that demonstrate how to exploit CVE-2023-27532 to gain access to the backup server.","start":5006,"end":5136},{"quote":"A Publicly Known Proof of Concept for CVE-2023-27532","start":5307,"end":5359}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-31287","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-31287","exploited":true,"exploitedSince":"2023-08-22","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":2,"earliest":"2023-03-18","earliestUrl":"https://github.com/horizon3ai/CVE-2023-27532","repos":[{"name":"sfewer-r7/CVE-2023-27532","url":"https://github.com/sfewer-r7/CVE-2023-27532","stars":115,"created":"2023-03-23"},{"name":"horizon3ai/CVE-2023-27532","url":"https://github.com/horizon3ai/CVE-2023-27532","stars":75,"created":"2023-03-18"}]},"first":{"date":"2023-03-18","source":"PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2023-27532"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1133"],"provenance":"source"},{"stage":"primary","techniques":["T1059.003"],"provenance":"source"},{"stage":"secondary","techniques":["T1555","T1087","T1087.001","T1486"],"provenance":"source"}],"timeline":[{"date":"2023-03-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27532","provenance":"source"},{"date":"2023-03-18","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2023-27532","provenance":"source"},{"date":"2023-04-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://labs.withsecure.com/publications/fin7-target-veeam-servers","provenance":"source"},{"date":"2023-08-22","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-08-22","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-31287","provenance":"source"}],"speed":{"daysToPublicExploit":8,"firstExploitFrom":"PoC-in-GitHub","daysToKev":165},"priority":{"score":82.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1282 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9962"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-veeam-backup-replication-cwe-306"}}