---
id: "CVE-2022-26500"
kind: "vulnerability"
aliases: ["CVE-2022-26500"]
title: "veeam backup \\& replication: Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote\u2026"
severity: "critical"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Veeam Backup & Replication", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Veeam Backup & Replication", "fixed": ["10.0.1.4854 P20220304", "11.0.1.1261 P20220302"], "affected": "9.5 U3/U4, 10.x < 10.0.1.4854 P20220304, 11.x < 11.0.1.1261 P20220302", "ecosystem": "vendor"}, {"name": "veeam backup \\& replication", "fixed": ["10.0.1.4854"], "affected": ">= 10.0.0.4442, < 10.0.1.4854", "ecosystem": "vendor"}, {"name": "veeam backup \\& replication", "fixed": ["11.0.1.1261"], "affected": ">= 11.0.0.825, < 11.0.1.1261", "ecosystem": "vendor"}, {"name": "veeam backup \\& replication", "fixed": [], "affected": "= 9.5.0.1536", "ecosystem": "vendor"}, {"name": "veeam backup \\& replication", "fixed": [], "affected": "= 9.5.4.2615", "ecosystem": "vendor"}, {"name": "veeam backup \\& replication", "fixed": [], "affected": "= 10.0.1.4854", "ecosystem": "vendor"}, {"name": "veeam backup \\& replication", "fixed": [], "affected": "= 11.0.1.1261", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["backup-server", "exploited", "infrastructure", "ransomware", "self-hosted", "veeam", "windows"]
not_affected_if: ["isolated-network", "patched-build", "unknown"]
published_at: "2022-03-17T21:15:08+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26500", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:10:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26500", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# veeam backup \& replication: Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote…

Veeam Distribution Service (TCP 9380 by default) exposes internal API functions. A remote attacker can upload and execute code on the backup server. Veeam rates it Critical, CVSS 9.8, and says no authentication is needed. NVD lists it as path traversal (CWE-22) at 8.8 with low privileges required. It is exploited in the wild and on CISA KEV, and backup servers are common ransomware targets.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Veeam Backup & Replication affected ? fixed ?
- vendor:Veeam Backup & Replication affected 9.5 U3/U4, 10.x < 10.0.1.4854 P20220304, 11.x < 11.0.1.1261 P20220302 fixed 10.0.1.4854 P20220304, 11.0.1.1261 P20220302
- vendor:veeam backup \& replication affected >= 10.0.0.4442, < 10.0.1.4854 fixed 10.0.1.4854
- vendor:veeam backup \& replication affected >= 11.0.0.825, < 11.0.1.1261 fixed 11.0.1.1261
- vendor:veeam backup \& replication affected = 9.5.0.1536 fixed ?
- vendor:veeam backup \& replication affected = 9.5.4.2615 fixed ?
- vendor:veeam backup \& replication affected = 10.0.1.4854 fixed ?
- vendor:veeam backup \& replication affected = 11.0.1.1261 fixed ?

## How to check

In the Veeam console open Help > About and read the build number. Exposed if it is 9.5 U3/U4, 10/10a below 10.0.1.4854 P20220304, or 11/11a below 11.0.1.1261 P20220302. Also check whether TCP 9380 on the backup server is reachable from untrusted networks. New installs from ISOs dated 20220302 or later are not vulnerable.

## Fix

Install the cumulative patch on the Veeam Backup & Replication server: 11a build 11.0.1.1261 P20220302 (KB4245) or 10a build 10.0.1.4854 P20220304 (KB4291). Managed servers running the Distribution Service update automatically. 9.5 and plain 10 or 11 should upgrade to 11a or later. Block TCP 9380 from untrusted networks.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26500
- 2026-10-23T21:10:44+00:00 analyst — Veeam KB4288 (primary) gives fixed builds 11a 11.0.1.1261 P20220302 and 10a 10.0.1.4854 P20220304; 9.5 has no patch, so upgrade. Exploitation is per CISA KEV and NHS England. No PoC link was read. NVD describes it as authenticated path traversal at CVSS 8.8, while Veeam rates it 9.8 unauthenticated.
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-26500

## Documents

- [advisory] Veeam KB4288: CVE-2022-26500 | CVE-2022-26501 https://www.veeam.com/kb4288
- [discussion] NHS England Digital: Veeam security updates, exploitation reported https://digital.nhs.uk/cyber-alerts/2022/cc-4055
- [fix] KB4291: Veeam B&R 10a Cumulative Patch P20220304 https://www.veeam.com/kb4291

## From the sources

The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_