CVE-2022-26501: Veeam Backup & Replication Remote Code Execution Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-12-13. EPSS: 4.1% chance of exploitation in the next 30 days.

Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

Affected products

• Veeam Veeam Backup & Replication: from 10.0.0.4442, before 10.0.1.4854 (fixed in 10.0.1.4854); from 11.0.0.825, before 11.0.1.1261 (fixed in 11.0.1.1261); version 10.0.1.4854 only; version 11.0.1.1261 only

Published 2022-03-17. Last modified 2026-06-17.