Unauthenticated Authorization Bypass in Veeam CDP Coordinator Service

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

Authenticated Restore Operator Can Write Arbitrary Files via Path Traversal on Veeam Backup Server

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.

Authenticated Relative Path Traversal Allowing Write to Arbitrary Paths on Veeam Backup Server

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.

Remote Code Execution via Authenticated Domain User in Veeam Backup Server

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.

Privilege Escalation via Unauthorized Master Key Modification in Veeam Backup & Replication

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.

Authenticated Cloud Connect Tenant Can Read Arbitrary Files on Veeam Service Provider Host

This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.

Cleartext Credential Logging in Support Logs

A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials.

Local Privilege Escalation via Veeam Updater Component

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system.

Local Privilege Escalation in Veeam Agent for Microsoft Windows

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

Arbitrary File Write on Linux Veeam Backup Server via Authenticated Backup Administrator

A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.

Veeam Backup and Replication Low‑Privileged SSH Credential Extraction Vulnerability

A vulnerability allowing a low-privileged user to extract saved SSH credentials.

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

Authenticated Domain User Remote Code Execution in Veeam Backup and Replication

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.

A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share and are executed with elevated privileges by default. The user can update a job and schedule it to run almost immediately, allowing arbitrary code execution on the server.