Live › vulnerability › CVE-2022-26500
Go to dashboardVeeam Distribution Service (TCP 9380 by default) exposes internal API functions. A remote attacker can upload and execute code on the backup server. Veeam rates it Critical, CVSS 9.8, and says no authentication is needed. NVD lists it as path traversal (CWE-22) at 8.8 with low privileges required. It is exploited in the wild and on CISA KEV, and backup servers are common ransomware targets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Veeam Backup & Replication | vendor | – | – |
| Veeam Backup & Replication | vendor | 9.5 U3/U4, 10.x < 10.0.1.4854 P20220304, 11.x < 11.0.1.1261 P20220302 | 10.0.1.4854 P20220304, 11.0.1.1261 P20220302 |
| veeam backup \& replication | vendor | >= 10.0.0.4442, < 10.0.1.4854 | 10.0.1.4854 |
| veeam backup \& replication | vendor | >= 11.0.0.825, < 11.0.1.1261 | 11.0.1.1261 |
| veeam backup \& replication | vendor | = 9.5.0.1536 | – |
| veeam backup \& replication | vendor | = 9.5.4.2615 | – |
| veeam backup \& replication | vendor | = 10.0.1.4854 | – |
| veeam backup \& replication | vendor | = 11.0.1.1261 | – |
10.0.1.4854 P20220304, or 11/11a below 11.0.1.1261 P2022030211.0.1.1261 P20220302 (KB4245) or 10a build 10.0.1.4854 P20220304 (KB4291)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2022-26500")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.