Veeam Backup and Recovery
14 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-59470 | 13.0.0 | This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or o | CRITICAL 9.0 | 1.5 % | ||
| CVE-2025-59469 | 13.0.0 | This vulnerability allows a Backup or Tape Operator to write files as root. | CRITICAL 9.0 | 0.7 % | ||
| CVE-2025-59468 | 13.0.0 | This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious passwor | CRITICAL 9.1 | 1.2 % | ||
| CVE-2025-55125 | 13.0.0 | This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configura | CRITICAL 9.8 | 1.0 % | ||
| CVE-2025-24286 | 12.3 | A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code. | HIGH 7.2 | 19 % | ||
| CVE-2025-23121 | 12.3.1 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user | CRITICAL 9.9 | 25 % | ||
| CVE-2025-23120 | 12.3 | A vulnerability allowing remote code execution (RCE) for domain users. | CRITICAL 9.9 | 24 % | ||
| CVE-2024-40714 | 12.1.2 | An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive | HIGH 8.3 | 0.4 % | ||
| CVE-2024-40713 | 12.1.2 | A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authe | HIGH 7.8 | 0.3 % | ||
| CVE-2024-40712 | 12.1.2 | A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege es | HIGH 7.8 | 0.3 % | ||
| CVE-2024-40711 | 12.1.2 | A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). | CRITICAL 9.8 | 90 % | KEV | |
| CVE-2024-40710 | 12.1.2 | A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extracti | HIGH 8.8 | 1.1 % | ||
| CVE-2024-40709 | 12.1.2 | A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level. | HIGH 7.8 | 0.2 % | ||
| CVE-2024-39718 | 12.1.2 | An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equival | HIGH 8.1 | 0.8 % |