UpHeron
All vulnerabilities

Servers and applications

CVE-2022-26501

Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 13 Dec 2022.

Severity
Critical 9.8
Published
17 Mar 2022
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
10.0.1.4854, 11.0.1.1261
Sources
NVD

Affected software

SoftwareAffected versions
Veeam Backup & ReplicationServers and applications · cpe:a:veeam:veeam_backup_\&_replication
  • Version 11.0.1.1261-p20211211
  • Version 11.0.1.1261-p20211123
  • Version 11.0.1.1261
  • From 11.0.0.825 before 11.0.1.1261
All 8 release lines
  • From 10.0.0.4442 before 10.0.1.4854
  • Version 10.0.1.4854
  • Version 10.0.1.4854-p20201202
  • Version 10.0.1.4854-p20210609
  • From 11.0.0.825 before 11.0.1.1261
  • Version 11.0.1.1261
  • Version 11.0.1.1261-p20211123
  • Version 11.0.1.1261-p20211211

Known exploited

CISA name
Veeam Backup & Replication Remote Code Execution Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
3 Jan 2023
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-26501
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-26501