CVE-2022-26500: Veeam Backup & Replication Remote Code Execution Vulnerability
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
Other sources
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Stop and disable the Veeam Distribution Service on Backup & Replication servers until a vendor fix is available to prevent unauthenticated access to internal APIs.
Veeam Distribution Service service_state = stopped/disabled - Compensating control
Restrict network access to the Veeam Distribution Service/internal API: block the service ports at firewalls and ACLs, allow access only from trusted management IPs/networks, and isolate Backup & Replication servers from untrusted networks.
- Operational
Audit Backup & Replication servers for signs of unauthorized uploads or execution (check for unknown files, new executables, modified services, scheduled tasks, and relevant logs). If compromise is suspected, isolate affected hosts and follow incident response procedures. Apply vendor-provided patches or updates as soon as they are released.
Event History
Frequently Asked Questions
What is CVE-2022-26500?
CVE-2022-26500 is a vulnerability in Veeam Backup & Replication that allows unauthenticated users to access internal API functions, leading to potential remote code execution.
Which software versions are affected by CVE-2022-26500?
CVE-2022-26500 affects Veeam Backup & Replication versions 9.5.0.1536, 9.5.4.2615, 10.0.0.4442 to 10.0.1.4854, and 11.0.0.825 to 11.0.1.1261.
How severe is CVE-2022-26500?
CVE-2022-26500 has a severity rating of 8.8 (high).
How can an attacker exploit CVE-2022-26500?
An attacker can exploit CVE-2022-26500 by sending input to the internal API of Veeam Backup & Replication, potentially allowing them to upload and execute malicious code.
How can I protect my system from CVE-2022-26500?
To protect your system from CVE-2022-26500, it is recommended to update Veeam Backup & Replication to the latest version available and follow any security recommendations provided by the vendor.