Veeam Backup and Replication
21 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-108142 | 13.0 – < 13.0.3 ; 13.1 – < 13.1.2 | A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. | CRITICAL 9.1 | |||
| CVE-2026-108141 | 13.0 – < 13.0.3 ; 13.1 – < 13.1.2 | A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to w | MEDIUM 5.9 | |||
| CVE-2026-108140 | 13.0 – < 13.0.3 ; 13.1 – < 13.1.2 | A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to w | MEDIUM 5.9 | |||
| CVE-2026-93026 | 12 – < 12.3.2.4934 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus upd | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-58069 | 12 – 12.3.2 ; 13 – 13.0.3 | This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provide | HIGH 8.3 | 0.4 % | ||
| CVE-2025-64393 | 12 – < 12.3.2.4934 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server. | CRITICAL 9.4 | 5.2 % | ||
| CVE-2026-58070 | < 13.0.3 | A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-56844 | | A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and | HIGH 8.4 | 0.2 % | ||
| CVE-2026-44963 | < 12.3.2 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. | CRITICAL 9.4 | 2.4 % | ||
| CVE-2026-32997 | 13 – 13.0.1 | A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Rep | HIGH 8.6 | 0.5 % | ||
| CVE-2026-32996 | 13 – 13.0.1 | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. | HIGH 7.3 | 0.2 % | ||
| CVE-2026-21709 | 12 – < 12.3.2 | A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement. | MEDIUM 6.7 | 0.2 % | ||
| CVE-2026-21708 | 12 – < 12.3.2 ; 13 – < 13.0.1 | A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user. | CRITICAL 9.9 | 1.1 % | ||
| CVE-2026-21672 | 12 – < 12.3.2 ; 13 – < 13.0.1 | A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers. | HIGH 8.8 | 0.2 % | ||
| CVE-2026-21670 | 13.0.1 – < 13.0.1 | A vulnerability allowing a low-privileged user to extract saved SSH credentials. | HIGH 7.7 | 0.4 % | ||
| CVE-2026-21669 | 13.0.1 – < 13.0.1 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. | CRITICAL 10.0 | 1.2 % | ||
| CVE-2026-21668 | 12.3.2 – < 12.3.2 | A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository. | HIGH 8.8 | 0.5 % | ||
| CVE-2026-21667 | | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. | CRITICAL 10.0 | 1.1 % | ||
| CVE-2026-21666 | 12.3.2 – < 12.3.2 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. | CRITICAL 10.0 | 1.1 % | ||
| CVE-2025-48983 | 12.3.2 | A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructur | CRITICAL 10.0 | 0.8 % | ||
| CVE-2025-48984 | 12.3.2 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. | HIGH 8.8 | 1.0 % |