CVE-2022-26501
Published 2022-03-17 · Updated 2026-06-17 · Source cve@mitre.org
Summary
CVE-2022-26501 is a critical-severity (CVSS 9.8) vulnerability in Veeam Backup & Replication. CISA added it to the Known Exploited Vulnerabilities catalog on December 13, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by January 3, 2023. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Veeam has 4 vulnerabilities in the KEV catalog, 4 of them linked to ransomware.
All 4 known-exploited Veeam vulnerabilities →Description
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Veeam — Backup & Replication
Name: Veeam Backup & Replication Remote Code Execution Vulnerability
Date added: 2022-12-13 · Due: 2023-01-03
Required action: Apply updates per vendor instructions.