We would like to bring your attention to the following unauthenticated remote code execution vulnerability within Veeam Backup & Replication. This issue is being tracked as CVE-2022-26500 & CVE-2022-26501 and has been given the CVSS v3 score of 9.8.
At this time we are unaware of any proof of concept attacks or exploits for this issue being available in the wild, we will continue to monitor the situation around this.
Am I affected?
Versions of Veeam prior to the following versions are known to be vulnerable (including the unsupported version 9.5):
-
11a (build 11.0.1.1261 P20220302)
-
10a (build 10.0.1.4854 P20220304)
Remediation
Apply the patches provided by Veeam to your Veeam Backup and Replication Server:
References
-
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26500
-
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26501
Swarm spotlight on the community: Thomas Cox on hacking, humanity, and the future of cybersecurity.
In this episode of Swarm Spotlight, Jayson E. Street sits down with national security and cybersecurity veteran Thomas Cox for a candid conversation on hacker culture,…
The pod was never truly isolated.
“Just a container” is a comforting idea, but it’s usually wrong. Once someone gains execution inside a pod, the real question isn’t whether they can escape…
You can’t keep up, so prioritize better.
Attackers don’t need to find every route in. They just need one. COO Luke Potter argues the fix isn’t more scanning. It’s vulnerability prioritization: focus research…