Skip to content
Noroxi

Veeam records

78 published records for vendor veeam.

Researcher profile

Entered KEV
4 · 5.1%
Weaponized
6 · 7.7%
Pre-auth RCE
5
With a fix record
19.2%
Median publish → KEV
218 days

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 23
  6. 24
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

78 records
  • CVE-2024-40711
    96Now

    A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

    CriticalCVSS 9.8KEVWeaponizedEPSS 90%

    veeam · veeam backup \& replicationSep 7, 2024

  • CVE-2023-27532
    84Now

    Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained.

    HighCVSS 7.5KEVWeaponizedEPSS 80%

    veeam · veeam backup \& replicationMar 10, 2023

  • CVE-2022-26501
    70This week

    Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

    CriticalCVSS 9.8KEVWeaponizedEPSS 4%

    veeam · veeam backup \& replicationMar 17, 2022

  • CVE-2022-26500
    67This week

    Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to inte

    HighCVSS 8.8KEVWeaponizedEPSS 5%

    veeam · veeam backup \& replicationMar 17, 2022

  • CVE-2020-10915
    65This week

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.

    CriticalCVSS 9.8WeaponizedEPSS 86%

    veeam · oneApr 22, 2020

  • CVE-2020-10914
    60This week

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.

    CriticalCVSS 9.8WeaponizedEPSS 47%

    veeam · oneApr 22, 2020

  • CVE-2024-29849
    51Plan

    Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.

    CriticalCVSS 9.8Proof of conceptEPSS 38%

    veeam · veeam backup \& replicationMay 22, 2024

  • CVE-2020-15419
    48Plan

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415.

    HighCVSS 7.5No exploitEPSS 59%

    veeam · one firmwareJul 28, 2020

  • CVE-2023-38547
    45Plan

    A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its

    CriticalCVSS 9.8No exploitEPSS 18%

    veeam · oneNov 7, 2023

  • CVE-2025-23121
    42Plan

    A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user

    HighCVSS 8.8No exploitEPSS 24%

    veeam · veeam backup \& replicationJun 18, 2025

  • CVE-2025-23120
    42Plan

    A vulnerability allowing remote code execution (RCE) for domain users.

    HighCVSS 8.8No exploitEPSS 24%

    veeam · veeam backup \& replicationMar 20, 2025

  • CVE-2024-29855
    42Plan

    Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator

    CriticalCVSS 9.0Proof of conceptEPSS 21%

    veeam · recovery orchestratorJun 11, 2024

  • CVE-2024-29212
    39Monitor

    Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management ag

    CriticalCVSS 9.9No exploitEPSS 1%

    veeam · veeam service provider consoleMay 14, 2024

  • CVE-2021-35971
    39Monitor

    Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft

    CriticalCVSS 9.8No exploitEPSS 1%

    veeam · veeam backup \& replicationJun 30, 2021

  • CVE-2024-39714
    39Monitor

    A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution

    CriticalCVSS 9.9No exploitEPSS 1%

    veeam · veeam service provider consoleSep 7, 2024

  • CVE-2026-21669
    39Monitor

    A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

    CriticalCVSS 9.9No exploitEPSS 1%

    veeam · veeam backup \& replicationMar 12, 2026

  • CVE-2026-21708
    39Monitor

    A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

    CriticalCVSS 9.9No exploitEPSS 1%

    veeam · veeam backup \& replicationMar 12, 2026

  • CVE-2025-55125
    39Monitor

    This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configura

    CriticalCVSS 9.8No exploitEPSS 0%

    veeam · veeam backup & replicationJan 8, 2026

  • CVE-2024-38650
    39Monitor

    An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.

    CriticalCVSS 9.9No exploitEPSS 0%

    veeam · veeam service provider consoleSep 7, 2024

  • CVE-2025-48983
    39Monitor

    A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructur

    CriticalCVSS 9.9No exploitEPSS 0%

    veeam · veeam backup & replicationOct 31, 2025

  • CVE-2022-43549
    39Monitor

    Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms.

    CriticalCVSS 9.8No exploitEPSS 0%

    veeam · veeam backup for google cloudDec 5, 2022

  • CVE-2024-42455
    37Monitor

    A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserializat

    HighCVSS 8.1No exploitEPSS 15%

    veeam · veeam backup \& replicationDec 3, 2024

  • CVE-2022-26504
    36Monitor

    Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine

    HighCVSS 8.8No exploitEPSS 2%

    veeam · veeam backup \& replicationMar 17, 2022

  • CVE-2019-11569
    36Monitor

    Veeam ONE Reporter 9.5.0.3201 allows CSRF.

    HighCVSS 8.8Proof of conceptEPSS 2%

    veeam · one reporterMay 6, 2019

  • CVE-2025-59470
    36Monitor

    This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or o

    CriticalCVSS 9.0Proof of conceptEPSS 1%

    veeam · veeam backup & replicationJan 8, 2026