Veeam — known exploited vulnerabilities

The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Veeam with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.

4 KEV entries

4 ransomware-linked

1 product

avg CVSS 9.0

last added 2024-10-17

Key findings

CISA's Known Exploited Vulnerabilities catalog lists 4 Veeam vulnerabilities confirmed as exploited in the wild across 1 product; 4 of them (100%) are flagged as used in known ransomware campaigns. All entries affect a single product: Backup & Replication. CISA added 1 entry in 2024, compared with 1 in 2023. Across the 4 entries with an NVD CVSS score (100% of the total), the average score is 9.0; 2 entries are rated critical by NVD. The most recent addition is CVE-2024-40711 (Veeam Backup and Replication Deserialization Vulnerability), added on 2024-10-17.

Affected products

Product	Entries	Share
Backup & Replication	4	100%

Entries added per year

By date added to the KEV catalog

Exploited Veeam vulnerabilities (4)

Newest first. CVSS scores from NVD where available.

CVE	Product	Vulnerability	Date added	Ransomware	CVSS
CVE-2024-40711	Backup & Replication	Veeam Backup and Replication Deserialization Vulnerability	2024-10-17	Known	CRITICAL9.8
CVE-2023-27532	Backup & Replication	Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability	2023-08-22	Known	HIGH7.5
CVE-2022-26500	Backup & Replication	Veeam Backup & Replication Remote Code Execution Vulnerability	2022-12-13	Known	HIGH8.8
CVE-2022-26501	Backup & Replication	Veeam Backup & Replication Remote Code Execution Vulnerability	2022-12-13	Known	CRITICAL9.8

Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.