high8.8Known exploited
CVE-2022-26500
Veeam Backup & Replication Remote Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-12-13. Federal due date: 2023-01-03.
Apply updates per vendor instructions.
Impact
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Veeam | Veeam Backup \& Replication | from 10.0.0.4442 before 10.0.1.4854 from 11.0.0.825 before 11.0.1.1261 Versions 9.5.0.1536, 9.5.4.2615, 10.0.1.4854, 11.0.1.1261 |