Veeam Software has released updates to two critical security vulnerabilities affecting Backup & Replication, a backup solution for virtual environments.
Unauthenticated threat actors can exploit two security vulnerabilities tracked with codes CVE-2022-26500 and CVE-2022-26501 to remote code execution. The vulnerabilities exist in the Veeam Distribution service running on TCP port 9380 by default, allowing unauthenticated users to access internal Veeam API functions. Threat actors who exploit vulnerabilities to execute code on the target system can send inputs to the Veeam API to load and run malicious code.
Critical vulnerabilities affect Veeam Backup & Replication versions 9.5, 10, and 11. Unfortunately, Veeam Software has only released updates that fix the vulnerability for versions 10 and 11. For this reason, it is recommended that users using version 9.5 upgrade to a supported version.
What do the two Veeam flaws do?
Both flaws sit in the Veeam Distribution Service, which listens on TCP port 9380 by default. According to Veeam’s own knowledge base article KB4288, the service exposes internal API functions to unauthenticated users. Veeam rates both issues as critical, with a CVSS v3 score of 9.8, and says they can lead to remote code execution without logging in.
The National Vulnerability Database entry for CVE-2022-26501 describes it as incorrect access control in Veeam Backup & Replication 10.x and 11.x. NVD lists a CVSS 3.1 base score of 9.8 for it. The entry for CVE-2022-26500 describes improper limitation of path names, which gives access to internal API functions that can upload and run arbitrary code. NVD scores that entry at 8.8 and lists versions 9.5U3, 9.5U4, 10.x and 11.x.
Which versions are fixed?
Veeam published fixes for two release lines. Version 11a is fixed in build 11.0.1.1261 (P20220302), and version 10a is fixed in build 10.0.1.4854 (P20220304). There is no patch for version 9.5, so the advice is to move to a supported version. New installs of 11a and 10a made from ISO images dated 20220302 or later are not vulnerable.
If you cannot patch at once, Veeam describes a temporary step. Stop and disable the Veeam Distribution Service on the Backup & Replication server. Do the same on any distribution servers used in Protection Groups.
Why do backup servers matter to attackers?
A backup server holds copies of data and often has wide access to the systems it protects. Code running on it can reach both.
The US Cybersecurity and Infrastructure Security Agency (CISA) added both CVEs to its Known Exploited Vulnerabilities catalog on 13 December 2022, with a due date of 3 January 2023 for US federal agencies. That entry is a sign that the flaws were used in real attacks, not only in lab tests.
What should you do now?
- Check which Veeam Backup & Replication version you run and install the fixed build for 10a or 11a.
- Move any version 9.5 server to a supported release.
- Make sure TCP port 9380 on the backup server is not reachable from the internet or from broad parts of your network.
- Keep at least one backup copy that attackers cannot reach from the backup server, such as an offline or immutable copy.
Veeam’s updates of 27 October 2026 fix five newer flaws in Backup & Replication, its Linux agent and Veeam ONE, described in our post on the Veeam Backup and Replication patch.
For more on how Brandefense tracks weak spots like these, see cyber threat intelligence and our security news archive.