{"id":"CVE-2022-26501","kind":"vulnerability","aliases":["CVE-2022-26501"],"related":[],"title":"veeam backup \\& replication: Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2)","description":"The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Veeam Distribution Service (TCP 9380 by default) lets unauthenticated users reach internal API functions; crafted input uploads and runs code on the backup server (CVSS 9.8, Veeam rates Critical). Patch must be installed on the VBR server; managed servers running the Distribution Service update automatically afterward. New 11a/10a deployments from ISOs dated 20220302 or later are not vulnerable.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2022-12-13T00:00:00+00:00","products":[{"name":"Veeam Backup & Replication","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Veeam Backup & Replication","fixed":["10.0.1.4854 P20220304","11.0.1.1261 P20220302"],"affected":"9.5, 10 < 10.0.1.4854 P20220304, 11 < 11.0.1.1261 P20220302","ecosystem":"vendor"},{"name":"veeam backup \\& replication","fixed":["10.0.1.4854"],"affected":">= 10.0.0.4442, < 10.0.1.4854","ecosystem":"vendor"},{"name":"veeam backup \\& replication","fixed":["11.0.1.1261"],"affected":">= 11.0.0.825, < 11.0.1.1261","ecosystem":"vendor"},{"name":"veeam backup \\& replication","fixed":[],"affected":"= 10.0.1.4854","ecosystem":"vendor"},{"name":"veeam backup \\& replication","fixed":[],"affected":"= 11.0.1.1261","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["backup-servers","exploited","infrastructure","ransomware","self-hosted","veeam","windows"],"not_affected_if":["new-install-iso-20220302-or-later","patched-10.0.1.4854","patched-11.0.1.1261","unknown"],"how_to_check":"In the VBR console (Help > About) or on the server, read the build number. Vulnerable if below 11.0.1.1261 P20220302 (v11) or 10.0.1.4854 P20220304 (v10), or on 9.5. Exposure: check whether TCP 9380 on the backup server is reachable from untrusted networks (e.g. netstat -an | findstr 9380 on the server, or a port scan from another segment).","fix":"Install the cumulative patch: 11a build 11.0.1.1261 P20220302 or 10a build 10.0.1.4854 P20220304, or upgrade to current VBR (10a can only upgrade to 11a or later). 9.5 must be upgraded. Block TCP 9380 from untrusted networks meanwhile (my suggestion; not a Veeam-listed workaround).","status":"open","published_at":"2022-03-17T21:15:08+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:52+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T21:08:52Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per vendor instructions; the specific fixed version is not stated in the sources.","reach":"network","impact":"high","summary":"Veeam Backup & Replication has an unauthenticated flaw in its Veeam Distribution Service internal API. A remote attacker can send crafted input that uploads and runs malicious code on the backup server.","category":"infrastructure","who_cares":["veeam","backup-servers","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary code on the Veeam backup server.","analyst_note":"Find the fixed build and affected version range in the Veeam advisory for CVE-2022-26501 and a check for the Distribution Service exposure; sources here give neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000451,"input_tokens":2821,"output_tokens":338,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed build and affected version range in the Veeam advisory for CVE-2022-26501 and a check for the Distribution Service exposure; sources here give neither.","search":"'-2022':21A,24A '-26501':22A,25A '1':17A '10':7A '11':10A '11a/10a':102B '2':19A '20220302':107B '9.8':80B '9380':59B 'access':14A,126C 'action':152C 'afterward':100B 'allow':122C 'api':67B,128C,139C 'appli':153C 'applic':121C 'attack':132C 'automat':99B 'backup':2A,5A,27A,30A,33A,36A,39A,42A,45B,77B,119C 'backup-serv':44B 'cisa':150C 'code':74B,149C 'control':15A 'craft':69B 'critic':83B 'cve':20A,23A 'cvss':79B 'date':106B 'default':61B 'deploy':103B 'distribut':56B,96B,115C 'execut':146C 'exploit':47B 'function':68B,129C 'host':52B 'incorrect':13A 'infrastructur':48B 'input':70B,135C 'instal':87B 'instruct':157C 'intern':66B,127C,138C 'iso':105B 'issu':16A 'later':109B 'lead':142C 'let':62B 'malici':148C 'manag':92B 'may':141C 'must':85B 'new':101B 'patch':84B 'per':155C 'ransomwar':49B 'rate':82B 'reach':65B 'remot':131C 'replic':3A,6A,120C 'replication':28A,31A,34A,37A,40A,43A 'requir':151C 'run':73B,94B 'self':51B 'self-host':50B 'send':134C 'server':46B,78B,91B,93B 'servic':57B,97B,116C 'tcp':58B 'unauthent':63B,123C 'updat':98B,154C 'upload':71B,144C 'user':64B,124C 'vbr':90B 'veeam':1A,4A,26A,29A,32A,35A,38A,41A,53B,55B,81B,114C 'vendor':156C 'vulner':112B 'window':54B 'x':8A,11A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-03-17T21:15:08+00:00","kev":{"dateAdded":"2022-12-13","dueDate":"2023-01-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-26501","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26501","severity":null,"published_at":"2022-12-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2022-26501:41","url":null,"severity":null,"published_at":"2026-10-23T21:10:22+00:00","modified_at":"2026-10-23T21:10:22+00:00","first_seen_at":"2026-10-23T21:10:22+00:00","fetched_at":"2026-10-23T21:10:22+00:00","note":"Veeam KB4288 (shared with CVE-2022-26500): affects VBR 9.5, 10, 11; fixed by 11a build 11.0.1.1261 P20220302 and 10a build 10.0.1.4854 P20220304; exploitation per KEV. No public PoC link found; 9.5 has no patch, upgrade."},{"source":"nvd","external_id":"CVE-2022-26501","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26501","severity":null,"published_at":"2022-03-17T21:15:08+00:00","modified_at":"2026-06-17T04:35:18+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[{"id":910,"url":"https://www.veeam.com/kb4288","title":"Veeam KB4288: CVE-2022-26500 | CVE-2022-26501","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":911,"url":"https://cert.europa.eu/publications/security-advisories/2022-019/pdf","title":"CERT-EU 2022-019: Multiple Critical Vulnerabilities in Veeam","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}