CVE-2024-22021: Veeam Availability Orchestrator

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to.

Affected products

• Veeam Availability Orchestrator: version 4.0 only
• Veeam Disaster Recovery Orchestrator: version 5.0 only
• Veeam Recovery Orchestrator: version 6.0 only

Published 2024-02-07. Last modified 2026-06-17.