We would like to bring your attention to the following unauthenticated remote code execution vulnerability within Veeam Backup & Replication. This issue is being tracked as CVE-2022-26500 & CVE-2022-26501 and has been given the CVSS v3 score of 9.8.
At this time we are unaware of any proof of concept attacks or exploits for this issue being available in the wild, we will continue to monitor the situation around this.
Am I Effected?
Versions of Veeam prior to the following versions are known to be vulnerable (including the unsupported version 9.5):
-
11a (build 11.0.1.1261 P20220302)
-
10a (build 10.0.1.4854 P20220304)
Remediation
Apply the patches provided by Veeam to your Veeam Backup and Replication Server:
References
-
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26500
-
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26501
The call nobody talks about
The attack call is the one that gets written up in the report. But in James Sheppard’s experience, it’s rarely the most important call he makes.
DORA Threat-Led Penetration Testing: What article 26 actually requires
Annual penetration testing does not satisfy DORA’s testing mandate. Here’s what Article 26 actually requires, who it applies to, and what a real TLPT exercise looks…
Deloitte ranks CovertSwarm among EMEA’s 500 fastest-growing tech companies.
Based on verified revenue growth of 595.89% over three years. Here’s what the number means and why the model behind it was built this way from…