{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Veeam vulnerabilities","home_page_url":"https://patchfirst.co/vendor/veeam/","feed_url":"https://patchfirst.co/feed/vendor/veeam.json","description":"New and newly exploited Veeam CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2023-22793","url":"https://patchfirst.co/cve/CVE-2023-22793/","title":"CVE-2023-22793: A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the…","content_text":"Veeam · Management Pack for Microsoft System Center. Not in CISA KEV. EPSS 0.5% (higher than 44.5% of CVEs). CVSS 9.3 CRITICAL. Priority 16.1 of 100.","summary":"A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the…","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:37:07.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.1,"kev":null,"epss":{"score":0.00526,"percentile":0.44533},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0"},"vendor":"Veeam","product":"Management Pack for Microsoft System Center","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-108142","url":"https://patchfirst.co/cve/CVE-2026-108142/","title":"CVE-2026-108142: A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service","content_text":"Veeam · Backup and Replication. Not in CISA KEV. EPSS 0.4% (higher than 34.3% of CVEs). CVSS 9.1 CRITICAL. Priority 14.3 of 100.","summary":"A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service","date_published":"2026-10-27T00:00:00.000Z","date_modified":"2026-10-28T14:47:07.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.3,"kev":null,"epss":{"score":0.00401,"percentile":0.34304},"cvss":{"score":9.1,"severity":"CRITICAL","version":"4.0"},"vendor":"Veeam","product":"Backup and Replication","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2025-64393","url":"https://patchfirst.co/cve/CVE-2025-64393/","title":"CVE-2025-64393: This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the…","content_text":"Veeam · Backup and Replication. Not in CISA KEV. EPSS 5.2% (higher than 92.5% of CVEs). CVSS 9.4 CRITICAL. Priority 27.3 of 100.","summary":"This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the…","date_published":"2026-10-07T00:00:00.000Z","date_modified":"2026-10-24T20:10:00.000Z","tags":[],"_patchfirst":{"reason":"published","priority":27.3,"kev":null,"epss":{"score":0.05199,"percentile":0.9247},"cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0"},"vendor":"Veeam","product":"Backup and Replication","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-44963","url":"https://patchfirst.co/cve/CVE-2026-44963/","title":"CVE-2026-44963: A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user","content_text":"Veeam · Backup and Replication. Not in CISA KEV. EPSS 2.4% (higher than 83.7% of CVEs). CVSS 9.4 CRITICAL. Public exploit code exists. Priority 69.9 of 100.","summary":"A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user","date_published":"2026-06-09T00:00:00.000Z","date_modified":"2026-06-10T10:04:13.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":69.9,"kev":null,"epss":{"score":0.02351,"percentile":0.83692},"cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0"},"vendor":"Veeam","product":"Backup and Replication","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-32996","url":"https://patchfirst.co/cve/CVE-2026-32996/","title":"CVE-2026-32996: This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation","content_text":"Veeam · Backup and Replication. Not in CISA KEV. EPSS 0.2% (higher than 5.9% of CVEs). CVSS 7.3 HIGH. Public exploit code exists. Priority 58.7 of 100.","summary":"This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation","date_published":"2026-05-28T00:00:00.000Z","date_modified":"2026-09-23T03:55:30.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":58.7,"kev":null,"epss":{"score":0.00167,"percentile":0.05946},"cvss":{"score":7.3,"severity":"HIGH","version":"4.0"},"vendor":"Veeam","product":"Backup and Replication","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-42448","url":"https://patchfirst.co/cve/CVE-2024-42448/","title":"CVE-2024-42448: From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is…","content_text":"Veeam · Service Provider Console. Not in CISA KEV. EPSS 20.4% (higher than 97.5% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 76.4 of 100.","summary":"From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is…","date_published":"2024-12-11T00:00:00.000Z","date_modified":"2024-12-12T14:42:44.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":76.4,"kev":null,"epss":{"score":0.20359,"percentile":0.97484},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.0"},"vendor":"Veeam","product":"Service Provider Console","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-40711#kev","url":"https://patchfirst.co/cve/CVE-2024-40711/","title":"[KEV] CVE-2024-40711: Veeam Backup and Replication Deserialization Vulnerability","content_text":"Veeam · Backup & Replication. In CISA KEV since 2024-10-17, known ransomware use. ENISA EUVD lists it as exploited. EPSS 90.4% (higher than 99.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.","summary":"Veeam Backup and Replication Deserialization Vulnerability","date_published":"2024-10-17T00:00:00.000Z","date_modified":"2026-06-17T07:46:23.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2024-10-17","ransomware":true},"epss":{"score":0.90369,"percentile":0.99799},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Veeam","product":"Backup & Replication","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-27532#kev","url":"https://patchfirst.co/cve/CVE-2023-27532/","title":"[KEV] CVE-2023-27532: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability","content_text":"Veeam · Backup & Replication. In CISA KEV since 2023-08-22, known ransomware use. ENISA EUVD lists it as exploited. EPSS 80.6% (higher than 99.62% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059.003 Windows Command Shell; T1087 Account Discovery; T1087.001 Local Account; T1486 Data Encrypted for Impact; T1555 Credentials from Password Stores. Named in 1 threat report. Priority 82.0 of 100.","summary":"Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability","date_published":"2023-08-22T00:00:00.000Z","date_modified":"2026-06-17T05:45:24.000Z","tags":["kev","ransomware","public-exploit","T1133","T1059.003","T1087","T1087.001","T1486","T1555"],"_patchfirst":{"reason":"kev","priority":82,"kev":{"dateAdded":"2023-08-22","ransomware":true},"epss":{"score":0.80599,"percentile":0.99624},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Veeam","product":"Backup & Replication","techniqueIds":["T1133","T1059.003","T1087","T1087.001","T1486","T1555"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-26501#kev","url":"https://patchfirst.co/cve/CVE-2022-26501/","title":"[KEV] CVE-2022-26501: Veeam Backup & Replication Remote Code Execution Vulnerability","content_text":"Veeam · Backup & Replication. In CISA KEV since 2022-12-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 4.1% (higher than 90.7% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1036 Masquerading; T1048 Exfiltration Over Alternative Protocol. Priority 73.0 of 100.","summary":"Veeam Backup & Replication Remote Code Execution Vulnerability","date_published":"2022-12-13T00:00:00.000Z","date_modified":"2026-06-17T04:35:18.000Z","tags":["kev","ransomware","T1190","T1059","T1036","T1048"],"_patchfirst":{"reason":"kev","priority":73,"kev":{"dateAdded":"2022-12-13","ransomware":true},"epss":{"score":0.04104,"percentile":0.90746},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Veeam","product":"Backup & Replication","techniqueIds":["T1190","T1059","T1036","T1048"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-26500#kev","url":"https://patchfirst.co/cve/CVE-2022-26500/","title":"[KEV] CVE-2022-26500: Veeam Backup & Replication Remote Code Execution Vulnerability","content_text":"Veeam · Backup & Replication. In CISA KEV since 2022-12-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 5.8% (higher than 93.1% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1036 Masquerading; T1048 Exfiltration Over Alternative Protocol. Priority 72.8 of 100.","summary":"Veeam Backup & Replication Remote Code Execution Vulnerability","date_published":"2022-12-13T00:00:00.000Z","date_modified":"2026-06-17T04:35:18.000Z","tags":["kev","ransomware","T1078","T1190","T1059","T1036","T1048"],"_patchfirst":{"reason":"kev","priority":72.8,"kev":{"dateAdded":"2022-12-13","ransomware":true},"epss":{"score":0.05828,"percentile":0.93146},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Veeam","product":"Backup & Replication","techniqueIds":["T1078","T1190","T1059","T1036","T1048"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-15419","url":"https://patchfirst.co/cve/CVE-2020-15419/","title":"CVE-2020-15419: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE…","content_text":"Veeam · ONE. Not in CISA KEV. EPSS 59.8% (higher than 99.13% of CVEs). CVSS 7.5 HIGH. Priority 25.1 of 100.","summary":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE…","date_published":"2020-07-28T00:00:00.000Z","date_modified":"2024-08-04T13:15:20.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.1,"kev":null,"epss":{"score":0.59786,"percentile":0.99128},"cvss":{"score":7.5,"severity":"HIGH","version":"3.0"},"vendor":"Veeam","product":"ONE","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-10915","url":"https://patchfirst.co/cve/CVE-2020-10915/","title":"CVE-2020-10915: This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent…","content_text":"VEEAM · One Agent. Not in CISA KEV. EPSS 86.6% (higher than 99.74% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 31.8 of 100.","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent…","date_published":"2020-04-22T00:00:00.000Z","date_modified":"2024-08-04T11:14:15.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":31.8,"kev":null,"epss":{"score":0.86619,"percentile":0.99739},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.0"},"vendor":"VEEAM","product":"One Agent","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}