---
id: "CVE-2022-26501"
kind: "vulnerability"
aliases: ["CVE-2022-26501"]
title: "veeam backup \\& replication: Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2)"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Veeam Backup & Replication", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Veeam Backup & Replication", "fixed": ["10.0.1.4854 P20220304", "11.0.1.1261 P20220302"], "affected": "9.5, 10 < 10.0.1.4854 P20220304, 11 < 11.0.1.1261 P20220302", "ecosystem": "vendor"}, {"name": "veeam backup \\& replication", "fixed": ["10.0.1.4854"], "affected": ">= 10.0.0.4442, < 10.0.1.4854", "ecosystem": "vendor"}, {"name": "veeam backup \\& replication", "fixed": ["11.0.1.1261"], "affected": ">= 11.0.0.825, < 11.0.1.1261", "ecosystem": "vendor"}, {"name": "veeam backup \\& replication", "fixed": [], "affected": "= 10.0.1.4854", "ecosystem": "vendor"}, {"name": "veeam backup \\& replication", "fixed": [], "affected": "= 11.0.1.1261", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["backup-servers", "exploited", "infrastructure", "ransomware", "self-hosted", "veeam", "windows"]
not_affected_if: ["new-install-iso-20220302-or-later", "patched-10.0.1.4854", "patched-11.0.1.1261", "unknown"]
published_at: "2022-03-17T21:15:08+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26501", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:10:22+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26501", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# veeam backup \& replication: Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2)

Veeam Distribution Service (TCP 9380 by default) lets unauthenticated users reach internal API functions; crafted input uploads and runs code on the backup server (CVSS 9.8, Veeam rates Critical). Patch must be installed on the VBR server; managed servers running the Distribution Service update automatically afterward. New 11a/10a deployments from ISOs dated 20220302 or later are not vulnerable.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Veeam Backup & Replication affected ? fixed ?
- vendor:Veeam Backup & Replication affected 9.5, 10 < 10.0.1.4854 P20220304, 11 < 11.0.1.1261 P20220302 fixed 10.0.1.4854 P20220304, 11.0.1.1261 P20220302
- vendor:veeam backup \& replication affected >= 10.0.0.4442, < 10.0.1.4854 fixed 10.0.1.4854
- vendor:veeam backup \& replication affected >= 11.0.0.825, < 11.0.1.1261 fixed 11.0.1.1261
- vendor:veeam backup \& replication affected = 10.0.1.4854 fixed ?
- vendor:veeam backup \& replication affected = 11.0.1.1261 fixed ?

## How to check

In the VBR console (Help > About) or on the server, read the build number. Vulnerable if below 11.0.1.1261 P20220302 (v11) or 10.0.1.4854 P20220304 (v10), or on 9.5. Exposure: check whether TCP 9380 on the backup server is reachable from untrusted networks (e.g. netstat -an | findstr 9380 on the server, or a port scan from another segment).

## Fix

Install the cumulative patch: 11a build 11.0.1.1261 P20220302 or 10a build 10.0.1.4854 P20220304, or upgrade to current VBR (10a can only upgrade to 11a or later). 9.5 must be upgraded. Block TCP 9380 from untrusted networks meanwhile (my suggestion; not a Veeam-listed workaround).

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26501
- 2026-10-23T21:10:22+00:00 analyst — Veeam KB4288 (shared with CVE-2022-26500): affects VBR 9.5, 10, 11; fixed by 11a build 11.0.1.1261 P20220302 and 10a build 10.0.1.4854 P20220304; exploitation per KEV. No public PoC link found; 9.5 has no patch, upgrade.
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-26501

## Documents

- [advisory] Veeam KB4288: CVE-2022-26500 | CVE-2022-26501 https://www.veeam.com/kb4288
- [describes] CERT-EU 2022-019: Multiple Critical Vulnerabilities in Veeam https://cert.europa.eu/publications/security-advisories/2022-019/pdf

## From the sources

The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_