Live › vulnerability › CVE-2022-26501
Go to dashboardVeeam Distribution Service (TCP 9380 by default) lets unauthenticated users reach internal API functions; crafted input uploads and runs code on the backup server (CVSS 9.8, Veeam rates Critical). Patch must be installed on the VBR server; managed servers running the Distribution Service update automatically afterward. New 11a/10a deployments from ISOs dated 20220302 or later are not vulnerable.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Veeam Backup & Replication | vendor | – | – |
| Veeam Backup & Replication | vendor | 9.5, 10 < 10.0.1.4854 P20220304, 11 < 11.0.1.1261 P20220302 | 10.0.1.4854 P20220304, 11.0.1.1261 P20220302 |
| veeam backup \& replication | vendor | >= 10.0.0.4442, < 10.0.1.4854 | 10.0.1.4854 |
| veeam backup \& replication | vendor | >= 11.0.0.825, < 11.0.1.1261 | 11.0.1.1261 |
| veeam backup \& replication | vendor | = 10.0.1.4854 | – |
| veeam backup \& replication | vendor | = 11.0.1.1261 | – |
11.0.1.1261 P20220302 (v11) or 10.0.1.4854 P20220304 (v10), or on 9.511.0.1.1261 P20220302 or 10a build 10.0.1.4854 P20220304, or upgrade to current VBR (10a can only upgrade to 11a or later). 9.5 must be upgradedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2022-26501")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.