CVE-2022-26500: Veeam Backup & Replication Remote Code Execution Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-12-13. EPSS: 5.8% chance of exploitation in the next 30 days.

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.

Affected products

• Veeam Veeam Backup & Replication: from 10.0.0.4442, before 10.0.1.4854 (fixed in 10.0.1.4854); from 11.0.0.825, before 11.0.1.1261 (fixed in 11.0.1.1261); version 9.5.0.1536 only; version 9.5.4.2615 only; version 10.0.1.4854 only; version 11.0.1.1261 only

Published 2022-03-17. Last modified 2026-06-17.