UpHeron
All vulnerabilities

Servers and applications

CVE-2022-26500

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 13 Dec 2022.

Severity
High 8.8
Published
17 Mar 2022
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
10.0.1.4854, 11.0.1.1261
Sources
NVD

Affected software

SoftwareAffected versions
Veeam Backup & ReplicationServers and applications · cpe:a:veeam:veeam_backup_\&_replication
  • Version 11.0.1.1261-p20211211
  • Version 11.0.1.1261-p20211123
  • Version 11.0.1.1261
  • From 11.0.0.825 before 11.0.1.1261
All 10 release lines
  • Version 9.5.0.1536
  • Version 9.5.4.2615
  • From 10.0.0.4442 before 10.0.1.4854
  • Version 10.0.1.4854
  • Version 10.0.1.4854-p20201202
  • Version 10.0.1.4854-p20210609
  • From 11.0.0.825 before 11.0.1.1261
  • Version 11.0.1.1261
  • Version 11.0.1.1261-p20211123
  • Version 11.0.1.1261-p20211211

Known exploited

CISA name
Veeam Backup & Replication Remote Code Execution Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
3 Jan 2023
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-26500
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-26500