VE
Vendor
Veeam
162
CVEs
5
On KEV
15
New 30D
Products
BR9.9
Backup & Replication
Backup
56 CVEs4 on KEV6 new
BF9.0
Backup for Microsoft 365
Veeam
4 CVEs0 on KEV4 new
ON10.0
One
Veeam
21 CVEs0 on KEV1 new
BE9.8
Backup Enterprise Manager
Veeam
5 CVEs0 on KEV1 new
AF7.8
Agent for Windows
Veeam
4 CVEs0 on KEV2 new
AF7.3
Agent for Linux
Veeam
1 CVEs0 on KEV1 new
BA9.8
Backup and Recovery
Veeam
14 CVEs1 on KEV0 new
SP9.9
Service Provider Console
Veeam
14 CVEs0 on KEV0 new
VS9.9
Veeam Service Provider Console
Veeam
6 CVEs0 on KEV0 new
AG8.8
Agent
Veeam
4 CVEs0 on KEV0 new
OR8.8
One Reporter
Veeam
3 CVEs0 on KEV0 new
RO9.0
Recovery Orchestrator
Veeam
3 CVEs0 on KEV0 new
VA7.8
Veeam Agent For Windows
Veeam
3 CVEs0 on KEV0 new
BF9.0
Backup for Microsoft Azure
Veeam
2 CVEs0 on KEV0 new
BF9.0
Backup for Nutanix AHV
Veeam
2 CVEs0 on KEV0 new
BF9.0
Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization
Veeam
2 CVEs0 on KEV0 new
OF7.5
One Firmware
Veeam
2 CVEs0 on KEV0 new
SA9.1
Software Appliance
Veeam
2 CVEs0 on KEV0 new
AF7.8
Agent for Microsoft Windows
Veeam
1 CVEs0 on KEV0 new
AO4.3
Availability Orchestrator
Veeam
1 CVEs0 on KEV0 new
BF9.0
Backup for AWS
Veeam
1 CVEs0 on KEV0 new
BF9.0
Backup for Google Cloud
Veeam
1 CVEs0 on KEV0 new
BF6.1
Backup for Microsoft Windows
Veeam
1 CVEs0 on KEV0 new
BF9.0
Backup for Salesforce
Veeam
1 CVEs0 on KEV0 new
DR4.3
Disaster Recovery Orchestrator
Veeam
1 CVEs0 on KEV0 new
EM7.7
Enterprise Manager
Veeam
1 CVEs0 on KEV0 new
MP6.1
Management Pack
Veeam
1 CVEs0 on KEV0 new
NA8.8
Nutanix AHV
Veeam
1 CVEs0 on KEV0 new
NK8.8
Nutanix KVM
Veeam
1 CVEs0 on KEV0 new
VE7.8
Veeam
Veeam
1 CVEs0 on KEV0 new
VA8.8
Veeam Availability Suite
Veeam
1 CVEs0 on KEV0 new
VB9.8
Veeam Backup For Google Cloud
Veeam
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-64394 New | BF Backup for Microsoft 365 Veeam | 4.3 | Oct 27 | A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to… |
| CVE-2026-108141 New | BR Backup & Replication Veeam | 5.9 | Oct 27 | A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an… |
| CVE-2026-106078 New | BF Backup for Microsoft 365 Veeam | 6.9 | Oct 27 | A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not… |
| CVE-2026-107671 New | ON ONE Veeam | 8.5 | Oct 27 | A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification |
| CVE-2026-108142 New | BR Backup & Replication Veeam | 9.1 | Oct 27 | A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service |
| CVE-2026-106077 New | BF Backup for Microsoft 365 Veeam | 8.3 | Oct 27 | A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges |
| CVE-2026-106076 New | BF Backup for Microsoft 365 Veeam | 9.0 | Oct 27 | A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to… |
| CVE-2026-108140 New | BR Backup & Replication Veeam | 5.9 | Oct 27 | A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an… |
| CVE-2026-105477 New | AF Agent for Linux Veeam | 7.3 | Oct 27 | A vulnerability in Veeam Agent for Linux allows for local privilege escalation |
| CVE-2025-64391 | AF Agent for Windows Veeam | 4.1 | Oct 7 | This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it |
| CVE-2025-64392 | BE Backup Enterprise Manager Veeam | 4.8 | Oct 7 | This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link |
| CVE-2026-93026 | BR Backup & Replication Veeam | 6.1 | Oct 7 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials |
| CVE-2026-58068 | AF Agent for Windows Veeam | 6.8 | Oct 7 | This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system |
| CVE-2026-58069 | BR Backup & Replication Veeam | 8.3 | Oct 7 | This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host |
| CVE-2025-64393 | BR Backup & Replication Veeam | 9.4 | Oct 7 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server |
| CVE-2026-64632 | ON ONE Veeam | 8.5 | Aug 26 | A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account |
| CVE-2026-58070 | BR Backup & Replication Veeam | 6.8 | Aug 26 | A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account… |
| CVE-2026-65641 | ON One Veeam | 9.3 | Aug 26 | A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account |
| CVE-2026-58072 | SP Service Provider Console Veeam | 9.0 | Aug 4 | A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution |
| CVE-2026-58074 | ON ONE Veeam | 8.6 | Aug 4 | A vulnerability allowing a high-privileged user to execute arbitrary code on the server |
| CVE-2026-64630 | ON ONE Veeam | 5.3 | Aug 4 | A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link |
| CVE-2026-58073 | SP Service Provider Console Veeam | 9.5 | Aug 4 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials |
| CVE-2026-64631 | ON ONE Veeam | 8.6 | Aug 4 | A vulnerability allowing a low-privileged user to inject SQL and extract database contents |
| CVE-2026-58075 | ON ONE Veeam | 8.7 | Aug 4 | A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally |
| CVE-2026-64633 | ON ONE Veeam | 10.0 | Aug 4 | A vulnerability allowing remote unauthenticated code execution on the agent host |
| CVE-2026-64634 | ON ONE Veeam | 8.4 | Aug 4 | A vulnerability allowing local privilege escalation to the Reporter service context |
| CVE-2026-58071 | SP Service Provider Console Veeam | 8.2 | Aug 4 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an… |
| CVE-2026-58067 | SP Service Provider Console Veeam | 8.7 | Aug 4 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service |
| CVE-2026-64635 | SP Service Provider Console Veeam | 5.3 | Jul 30 | Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the… |
| CVE-2026-56844 | BR Backup & Replication Veeam | 8.4 | Jul 22 | A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the… |
| CVE-2026-44963 | BR Backup & Replication Veeam | 9.4 | Jun 9 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user |
| CVE-2026-32998 | SP Service Provider Console Veeam | 9.4 | May 28 | This vulnerability in Veeam Service Provider Console allows for remote code execution |
| CVE-2026-32997 | BR Backup & Replication Veeam | 8.6 | May 28 | A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server |
| CVE-2026-32996 | BR Backup & Replication Veeam | 7.3 | May 28 | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation |
| CVE-2026-21709 | BR Backup & Replication Veeam | 6.7 | Apr 17 | A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement |
| CVE-2026-21708 | BR Backup & Replication Veeam | 9.9 | Mar 12 | A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user |
| CVE-2026-21672 | BR Backup & Replication Veeam | 8.8 | Mar 12 | A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers |
| CVE-2026-21668 | BR Backup & Replication Veeam | 6.5 | Mar 12 | A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository |
| CVE-2026-21669 | BR Backup & Replication Veeam | 9.9 | Mar 12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server |
| CVE-2026-21671 | BR Backup & Replication Veeam | 9.1 | Mar 12 | A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup &… |
| CVE-2026-21670 | BR Backup & Replication Veeam | 6.5 | Mar 12 | A vulnerability allowing a low-privileged user to extract saved SSH credentials |
| CVE-2026-21666 | BR Backup & Replication Veeam | 8.8 | Mar 12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server |
| CVE-2026-21667 | BR Backup & Replication Veeam | 8.8 | Mar 12 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server |
| CVE-2025-59468 | BR Backup & Replication Veeam | 9.1 | Jan 8 | This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter |
| CVE-2025-55125 | BR Backup & Replication Veeam | 9.8 | Jan 8 | This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file |
| CVE-2025-59469 | BR Backup & Replication Veeam | 9.0 | Jan 8 | This vulnerability allows a Backup or Tape Operator to write files as root |
| CVE-2025-59470 | BR Backup & Replication Veeam | 9.0 | Jan 8 | This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter |
| CVE-2025-48983 | BR Backup & Replication Veeam | 9.9 | Oct 30 | A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user |
| CVE-2025-48982 | AF Agent for Microsoft Windows Veeam | 7.8 | Oct 30 | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file |
| CVE-2025-48984 | BR Backup & Replication Veeam | 8.8 | Oct 30 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user |
| CVE-2025-24286 | BR Backup & Replication Veeam | 4.9 | Jun 18 | A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code |
| CVE-2025-23121 | BR Backup & Replication Veeam | 8.8 | Jun 18 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user |
| CVE-2025-24287 | BF Backup for Microsoft Windows Veeam | 6.1 | Jun 18 | A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with elevated permissions |
| CVE-2025-23120 | BR Backup & Replication Veeam | 8.8 | Mar 20 | A vulnerability allowing remote code execution (RCE) for domain users |
| CVE-2025-23114 | BF Backup for Nutanix AHV Veeam | 9.0 | Feb 5 | A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server |
| CVE-2025-23082 | BR Backup & Replication Veeam | 7.2 | Jan 14 | Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF) |
| CVE-2024-42448 | SP Service Provider Console Veeam | 9.9 | Dec 11 | From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC… |
| CVE-2024-45204 | BR Backup & Replication Veeam | 4.3 | Dec 4 | A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials |
| CVE-2024-42451 | BR Backup & Replication Veeam | 6.5 | Dec 4 | A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext |
| CVE-2024-42453 | BR Backup & Replication Veeam | 8.1 | Dec 4 | A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts |