---
id: "CVE-2023-27532"
kind: "vulnerability"
aliases: ["CVE-2023-27532"]
title: "veeam backup \\& replication: Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration\u2026"
severity: "high"
cvss: 7.5
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Veeam Backup & Replication", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "veeam backup \\& replication", "fixed": ["11.0.1.1261"], "affected": "< 11.0.1.1261", "ecosystem": "vendor"}, {"name": "veeam backup \\& replication", "fixed": [], "affected": "= 11.0.1.1261", "ecosystem": "vendor"}, {"name": "veeam backup \\& replication", "fixed": [], "affected": "= 12.0.0.1420", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["backup-infrastructure", "exploited", "package", "ransomware", "self-hosted", "veeam"]
not_affected_if: ["cloud-connect-not-used", "network-isolated-backup"]
published_at: "2023-03-10T22:15:10+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27532", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27532", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# veeam backup \& replication: Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration…

Veeam Backup & Replication's Cloud Connect component lets an unauthenticated user on the backup network retrieve encrypted credentials stored in the configuration database. Those credentials can then be used to reach the backup infrastructure hosts.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Veeam Backup & Replication affected ? fixed ?
- vendor:veeam backup \& replication affected < 11.0.1.1261 fixed 11.0.1.1261
- vendor:veeam backup \& replication affected = 11.0.1.1261 fixed ?
- vendor:veeam backup \& replication affected = 12.0.0.1420 fixed ?

## Fix

Apply the vendor mitigations per Veeam's advisory, or stop using the product if mitigations are unavailable (per CISA required action). Exact fixed build: unknown.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27532
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-27532

## From the sources

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_