CVE-2022-26501

This flaw means someone on the network may be able to do things they shouldn’t on your Veeam backup system, without needing a password or clicking anything. Because backups are what you rely on to recover after an attack, breaking access controls there can turn a cyber incident into a much bigger one—like ransomware you can’t fully undo.

This matters if you run Veeam Backup & Replication 10.x or 11.x on a system exposed to a network connection that could be reached by an attacker. It is a remote access control bypass that does not require authentication or user interaction.

In practice, treat it as a risk when the vulnerable Veeam service is reachable from an attacker (for example, from the internet or any network segment an attacker can access) and you are running a vulnerable version.

This is RED because it has been confirmed to be used in ransomware campaigns (CISA KEV), and it allows unauthorized remote actions without login. Attackers have a clear path to target the backup environment, which can directly impact your ability to recover and stay operational.

Act now: upgrade to the fixed version and follow vendor guidance immediately.

1. Confirm exposure

   • Identify your exact Veeam Backup & Replication version and build number.
   • Determine whether you are running Veeam Backup & Replication 10.x or 11.x.
   • Also confirm whether the relevant Veeam components/services are reachable from the network in a way an external or internal attacker could access.

2. Apply the fix

   • Upgrade to the fixed version: Veeam Backup & Replication 10.0.1.4854.
   • Use the vendor’s update instructions referenced by Veeam KB4288.

3. Verification after upgrade

   • Confirm the running Veeam build matches the fixed version.
   • Re-check that Veeam management/backup services are functioning normally after the upgrade.

4. If you cannot patch immediately

   • Contact Veeam support and follow the temporary mitigation guidance in Veeam KB4288.
   • Ensure you are applying any vendor-recommended restrictions for network reachability until the update is completed.

5. Timing notes (CISA KEV)

   • CISA KEV remediation due date was 2023-01-03. Given RED status and KEV listing, treat the remaining time as critical.

6. What to monitor

   • Look for unusual remote activity against Veeam-related services (unexpected requests and unauthorized attempts).
   • Monitor backup job failures or suspicious changes in backup configuration after any security-relevant event.

Severity is Critical (CVSS 9.8) and the vulnerability type is CWE-306 (Incorrect Access Control). The core issue is that remote attackers can bypass security restrictions without authentication or user interaction (network-based attack vector; no login required).

CISA KEV listing confirms this issue has been used in ransomware campaigns, meaning exploitation is considered real-world and active against organizations. No public exploit code is on record in the provided findings.

Patch status: Veeam provides a fix with a stated fixed version of 10.0.1.4854, with vendor guidance referenced by Veeam KB4288. EPSS is reported as a prediction (not used to reduce urgency due to KEV confirmation).