CVE-2020-15518: Veeam Availability Suite

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control over filesystem I/O requests.

Affected products

• Veeam Veeam Availability Suite: before 10.0 (fixed in 10.0)
• Veeam Veeam Backup & Replication: before 10.0 (fixed in 10.0)

Published 2020-07-03. Last modified 2026-06-17.