Veeam Veeam_backup_\&_replication
42 CVEs affecting Veeam Veeam_backup_\&_replication. Latest disclosed: 2026-03-12. Critical: 13, High: 24.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21708 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user. |
CVE-2026-21669 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2026-21667 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2026-21666 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. |
CVE-2025-48983 | Critical | 9.9 | 2025-10-31 | A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authe… |
CVE-2024-40711 | Critical | 9.8 | 2024-09-07 | A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). |
CVE-2024-29849 | Critical | 9.8 | 2024-05-22 | Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. |
CVE-2022-26501 | Critical | 9.8 | 2022-03-17 | Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). |
CVE-2021-35971 | Critical | 9.8 | 2021-06-30 | Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting. |
CVE-2026-21671 | Critical | 9.1 | 2026-03-12 | A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments… |
CVE-2025-59470 | Critical | 9.0 | 2026-01-08 | This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter. |
CVE-2025-59469 | Critical | 9.0 | 2026-01-08 | This vulnerability allows a Backup or Tape Operator to write files as root. |
CVE-2025-59468 | Critical | 9.0 | 2026-01-08 | This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter. |
CVE-2026-21668 | High | 8.8 | 2026-03-12 | A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository. |
CVE-2025-48984 | High | 8.8 | 2025-10-31 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. |
CVE-2025-23121 | High | 8.8 | 2025-06-19 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user |
CVE-2025-23120 | High | 8.8 | 2025-03-20 | A vulnerability allowing remote code execution (RCE) for domain users. |
CVE-2024-42456 | High | 8.8 | 2024-12-04 | A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuratio… |
CVE-2024-42452 | High | 8.8 | 2024-12-04 | A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escala… |
CVE-2024-40717 | High | 8.8 | 2024-12-04 | A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs… |