{"id":"CVE-2023-22793","kind":"vulnerability","aliases":["CVE-2023-22793"],"related":[],"title":"Veeam Management Pack: unauthenticated remote code execution on servers","description":"A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.","summary":"An unauthenticated attacker can run code remotely on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center. Veeam rates it Critical (CVSS v4.0 9.3); found in internal testing. Fixed only in 13.1.0.334.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Veeam Management Pack for Microsoft System Center","fixed":["13.1.0.334"],"affected":"<= 9.1 (all 9.x builds)","ecosystem":"vendor"}],"ecosystems":[],"tags":["microsoft-system-center","scom","self-hosted","veeam","vendor","windows"],"not_affected_if":["management-pack-13.1.0.334-installed","not-installed","service-not-installed"],"how_to_check":"In the Operations Manager console, Administration > Management Packs, check the Veeam MP version/build. Any 9.x build (9.1.0.3107 or earlier) is affected; 13.1.0.334 is fixed. Also check any server running the Veeam Virtualization Extensions service, including remote collectors.","fix":"Upgrade Veeam Management Pack for Microsoft System Center to 13.1 (build 13.1.0.334). No fix will be released for 9.x; upgrade to 13.1 is supported only from 9a (build 9.1.0.3107).","status":"open","published_at":"2026-10-29T23:16:54+00:00","first_seen_at":"2026-10-29T23:27:17+00:00","triaged_at":"2026-10-29T23:29:03+00:00","updated_at":"2026-10-29T23:30:25+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-10-29T23:29:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Veeam Management Pack: unauthenticated remote code execution on servers","impact":"high","summary":"The Veeam Virtualization Extensions service in Veeam Management Pack for Microsoft System Center has a flaw that lets an unauthenticated attacker run code remotely. Successful exploitation gives the attacker code execution on the affected server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["veeam","microsoft-system-center","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs on the server without any login.","analyst_note":"Find the affected and fixed Veeam Management Pack versions and the vendor advisory, using the NVD link for CVE-2023-22793.","how_to_check":"- Check whether the Veeam Management Pack for Microsoft System Center is installed and whether the Veeam Virtualization Extensions service is running.\n- Confirm the installed product version against the vendor advisory; the sources do not give affected version numbers.","plain_action":"","needs_analyst":true,"not_affected_if":["service-not-installed"],"who_is_affected":"Organizations running Veeam Management Pack for Microsoft System Center with the Veeam Virtualization Extensions service enabled. The sources do not state specific affected versions or other conditions, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000672,"input_tokens":4097,"output_tokens":525,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected and fixed Veeam Management Pack versions and the vendor advisory, using the NVD link for CVE-2023-22793.","search":"'-2023':11A,14A '-22793':12A,15A '13.1.0.334':71B '9.3':63B 'allow':74C 'attack':36B,77C 'center':22A,26B,56B,99C 'code':6A,39B,81C 'critic':60B 'cve':10A,13A 'cvss':61B 'execut':7A,82C 'extens':47B,90C 'fix':68B 'for':19A 'found':64B 'host':30B 'intern':66B 'manag':2A,51B,94C 'management':17A 'microsoft':20A,24B,54B,97C 'microsoft-system-cent':23B 'pack':3A,18A,52B,95C 'perform':79C 'rate':58B 'rce':83C 'remot':5A,40B,80C 'run':38B,43B,86C 'scom':27B 'self':29B 'self-host':28B 'server':9A,42B,85C 'servic':48B,91C 'system':21A,25B,55B,98C 'test':67B 'unauthent':4A,35B,76C 'v4.0':62B 'veeam':1A,16A,31B,45B,50B,57B,88C,93C 'vendor':32B 'virtual':46B,89C 'vulner':73C 'window':33B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Veeam Management Pack for Microsoft System Center with the Veeam Virtualization Extensions service enabled. The sources do not state specific affected versions or other conditions, so the exact exposure is unknown.","tier":"B","verified":{"fix":{"at":"2026-10-29T23:30:25Z","by":"analyst","doc":"https://www.veeam.com/kb4949","run_id":1114},"products":{"at":"2026-10-29T23:30:25Z","by":"analyst","doc":"https://www.veeam.com/kb4949","run_id":1114},"how_to_check":{"at":"2026-10-29T23:30:25Z","by":"analyst","doc":"https://www.veeam.com/kb4949","run_id":1114},"who_affected":{"at":"2026-10-29T23:30:25Z","by":"analyst","doc":"https://www.veeam.com/kb4949","run_id":1114}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T23:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2023-22793","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22793","severity":null,"published_at":"2026-10-29T23:16:54+00:00","modified_at":"2026-10-29T23:16:54+00:00","first_seen_at":"2026-10-29T23:27:17+00:00","fetched_at":"2026-10-29T23:27:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2023-22793:1114","url":null,"severity":null,"published_at":"2026-10-29T23:30:25+00:00","modified_at":"2026-10-29T23:30:25+00:00","first_seen_at":"2026-10-29T23:30:25+00:00","fetched_at":"2026-10-29T23:30:25+00:00","note":"Veeam KB4961 (read directly): affects MP 9.1 and all 9.x builds incl. VBR 13 compat patch; fixed in 13.1.0.334; no 9.x fix. Critical CVSS v4 9.3, unauthenticated. No exploitation or PoC seen in vendor text; not searched socially (B tier)."}],"documents":[{"id":20025,"url":"https://www.veeam.com/kb4961","title":"KB4961: Vulnerabilities Resolved in Veeam Management Pack 13.1","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":20026,"url":"https://www.veeam.com/kb4949","title":"KB4949: Release Information for Veeam Management Pack 13.1","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}