CVE-2022-26504: Critical severity veeam backup & replication vulnerability
Published Mar 17, 2022
·Updated
Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe
Affected Software
24 affected components
Veeam Backup \& Replication>=10.0.0.4442<10.0.1.4854
Veeam Backup \& Replication>=11.0.0.825<11.0.1.1261
Veeam Backup \& Replication=9.5.0.1536
Veeam Backup \& Replication=9.5.4.2615
Veeam Backup \& Replication=10.0.1.4854
Veeam Backup \& Replication=10.0.1.4854-p20201202
Veeam Backup \& Replication=10.0.1.4854-p20210609
Veeam Backup \& Replication=10.0.1.4854-p20220304
Veeam Backup \& Replication=11.0.1.1261
Veeam Backup \& Replication=11.0.1.1261-p20211123
Veeam Backup \& Replication=11.0.1.1261-p20211211
Veeam Backup \& Replication=11.0.1.1261-p20220302
Veeam Veeam Backup \& Replication>=10.0.0.4442<10.0.1.4854
Veeam Veeam Backup \& Replication>=11.0.0.825<11.0.1.1261
Veeam Veeam Backup \& Replication=9.5.0.1536
Veeam Veeam Backup \& Replication=9.5.4.2615
Veeam Veeam Backup \& Replication=10.0.1.4854
Veeam Veeam Backup \& Replication=10.0.1.4854-p20201202
Veeam Veeam Backup \& Replication=10.0.1.4854-p20210609
Veeam Veeam Backup \& Replication=10.0.1.4854-p20220304
Veeam Veeam Backup \& Replication=11.0.1.1261
Veeam Veeam Backup \& Replication=11.0.1.1261-p20211123
Veeam Veeam Backup \& Replication=11.0.1.1261-p20211211
Veeam Veeam Backup \& Replication=11.0.1.1261-p20220302
Event History
Mar 17, 2022
CVE Published
via MITRE·08:48 PM
Data Sourced
via MITRE·08:48 PM
Description
Frequently Asked Questions
1
What is CVE-2022-26504?
CVE-2022-26504 is a vulnerability that allows attackers to execute arbitrary code in Veeam Backup & Replication 9.5U3, 9.5U4, 10.x, and 11.x.
2
Which versions of Veeam Backup & Replication are affected by CVE-2022-26504?
Veeam Backup & Replication versions 9.5U3, 9.5U4, 10.x, and 11.x are affected by CVE-2022-26504.
3
What is the severity of CVE-2022-26504?
CVE-2022-26504 has a severity rating of 8.8 (critical).
4
How can this vulnerability be exploited?
This vulnerability can be exploited by attackers to execute arbitrary code via Veeam.Backup.PSManager.exe.
5
How can I fix CVE-2022-26504?
To fix CVE-2022-26504, update Veeam Backup & Replication to a version that is not affected by the vulnerability.