CVE-2022-26500: Veeam Backup & Replication Remote Code Execution Vulnerability

Published Mar 17, 2022
·
Updated

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.

Other sources

The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

CISA

Affected Software

21 affected components
Veeam Backup & Replication
Veeam Backup \& Replication>=10.0.0.4442<10.0.1.4854
Veeam Backup \& Replication>=11.0.0.825<11.0.1.1261
Veeam Backup \& Replication=9.5.0.1536
Veeam Backup \& Replication=9.5.4.2615
Veeam Backup \& Replication=10.0.1.4854
Veeam Backup \& Replication=10.0.1.4854-p20201202
Veeam Backup \& Replication=10.0.1.4854-p20210609
Veeam Backup \& Replication=11.0.1.1261
Veeam Backup \& Replication=11.0.1.1261-p20211123
Veeam Backup \& Replication=11.0.1.1261-p20211211
Veeam Veeam Backup \& Replication>=10.0.0.4442<10.0.1.4854
Veeam Veeam Backup \& Replication>=11.0.0.825<11.0.1.1261
Veeam Veeam Backup \& Replication=9.5.0.1536
Veeam Veeam Backup \& Replication=9.5.4.2615
Veeam Veeam Backup \& Replication=10.0.1.4854
Veeam Veeam Backup \& Replication=10.0.1.4854-p20201202
Veeam Veeam Backup \& Replication=10.0.1.4854-p20210609
Veeam Veeam Backup \& Replication=11.0.1.1261
Veeam Veeam Backup \& Replication=11.0.1.1261-p20211123
Veeam Veeam Backup \& Replication=11.0.1.1261-p20211211

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Stop and disable the Veeam Distribution Service on Backup & Replication servers until a vendor fix is available to prevent unauthenticated access to internal APIs.

    Veeam Distribution Service service_state = stopped/disabled
  2. Compensating control

    Restrict network access to the Veeam Distribution Service/internal API: block the service ports at firewalls and ACLs, allow access only from trusted management IPs/networks, and isolate Backup & Replication servers from untrusted networks.

  3. Operational

    Audit Backup & Replication servers for signs of unauthorized uploads or execution (check for unknown files, new executables, modified services, scheduled tasks, and relevant logs). If compromise is suspected, isolate affected hosts and follow incident response procedures. Apply vendor-provided patches or updates as soon as they are released.

Event History

Mar 17, 2022
CVE Published
via MITRE·08:56 PM
Data Sourced
via MITRE·08:56 PM
Description
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Dec 13, 2022
Known Exploited
via CISA·12:00 AM
Known Ransomware
via CISA·12:00 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2022-26500?

CVE-2022-26500 is a vulnerability in Veeam Backup & Replication that allows unauthenticated users to access internal API functions, leading to potential remote code execution.

2

Which software versions are affected by CVE-2022-26500?

CVE-2022-26500 affects Veeam Backup & Replication versions 9.5.0.1536, 9.5.4.2615, 10.0.0.4442 to 10.0.1.4854, and 11.0.0.825 to 11.0.1.1261.

3

How severe is CVE-2022-26500?

CVE-2022-26500 has a severity rating of 8.8 (high).

4

How can an attacker exploit CVE-2022-26500?

An attacker can exploit CVE-2022-26500 by sending input to the internal API of Veeam Backup & Replication, potentially allowing them to upload and execute malicious code.

5

How can I protect my system from CVE-2022-26500?

To protect your system from CVE-2022-26500, it is recommended to update Veeam Backup & Replication to the latest version available and follow any security recommendations provided by the vendor.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203