{"id":"CVE-2023-27532","kind":"vulnerability","aliases":["CVE-2023-27532"],"related":[],"title":"veeam backup \\& replication: Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration…","description":"Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Veeam Backup & Replication's Cloud Connect component lets an unauthenticated user on the backup network retrieve encrypted credentials stored in the configuration database. Those credentials can then be used to reach the backup infrastructure hosts.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2023-08-22T00:00:00+00:00","products":[{"name":"Veeam Backup & Replication","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"veeam backup \\& replication","fixed":["11.0.1.1261"],"affected":"< 11.0.1.1261","ecosystem":"vendor"},{"name":"veeam backup \\& replication","fixed":[],"affected":"= 11.0.1.1261","ecosystem":"vendor"},{"name":"veeam backup \\& replication","fixed":[],"affected":"= 12.0.0.1420","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["backup-infrastructure","exploited","package","ransomware","self-hosted","veeam"],"not_affected_if":["cloud-connect-not-used","network-isolated-backup"],"how_to_check":null,"fix":"Apply the vendor mitigations per Veeam's advisory, or stop using the product if mitigations are unavailable (per CISA required action). Exact fixed build: unknown.","status":"open","published_at":"2023-03-10T22:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:47+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:04:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per Veeam's advisory, or stop using the product if mitigations are unavailable (per CISA required action). Exact fixed build: unknown.","reach":"network","impact":"high","summary":"Veeam Backup & Replication's Cloud Connect component lets an unauthenticated user on the backup network retrieve encrypted credentials stored in the configuration database. Those credentials can then be used to reach the backup infrastructure hosts.","category":"package","who_cares":["veeam","backup-infrastructure","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker obtains stored credentials and gains access to backup hosts","analyst_note":"Find Veeam's advisory for CVE-2023-27532 to confirm the affected versions, fixed builds and the exact Cloud Connect mitigation steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["cloud-connect-not-used","network-isolated-backup"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000483,"input_tokens":2894,"output_tokens":387,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':18A,21A '-27532':19A,22A 'access':122C 'action':130C 'allow':10A,95C 'appli':131C 'attack':120C 'authent':89C 'backup':2A,7A,24A,27A,30A,33A,36B,46B,58B,77B,81C,102C,125C 'backup-infrastructur':35B 'cisa':128C 'cloud':49B,83C 'compon':9A,51B,85C 'configur':16A,66B,113C 'connect':50B,84C 'contain':86C 'credenti':12A,62B,69B,109C 'critic':91C 'cve':17A,20A 'databas':67B,114C 'discontinu':137C 'encrypt':11A,61B,108C 'exploit':38B 'function':92C 'gain':121C 'host':43B,79B,127C 'infrastructur':37B,78B,103C,126C 'instruct':135C 'lead':117C 'let':52B 'may':116C 'miss':88C 'mitig':132C,143C 'network':59B,104C 'obtain':107C 'oper':99C 'packag':39B 'per':133C 'perimet':105C 'product':141C 'ransomwar':40B 'reach':75B 'replic':3A,8A,47B,82C 'replication':25A,28A,31A,34A 'requir':129C 'retriev':60B 'self':42B 'self-host':41B 'store':13A,63B,110C 'unauthent':54B,97C 'unavail':145C 'use':73B,138C 'user':55B,98C 'veeam':1A,6A,23A,26A,29A,32A,44B,45B,80C 'vendor':134C 'vulner':4A,93C 'within':100C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-03-10T22:15:10+00:00","kev":{"dateAdded":"2023-08-22","dueDate":"2023-09-12","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-27532","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27532","severity":null,"published_at":"2023-08-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-27532","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27532","severity":null,"published_at":"2023-03-10T22:15:10+00:00","modified_at":"2026-06-17T05:45:24+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}