CVE-2022-26500
Veeam Backup & Replication Remote Code Execution Vulnerability
Description
CVE-2022-26500 is a path traversal vulnerability in Veeam Backup & Replication that allows remote authenticated users to access internal API functions, upload arbitrary files, and execute code on the server. Affecting Veeam Backup & Replication versions 9.5U3, 9.5U4, 10.x, and 11.x, this vulnerability has a CVSS score of 8.8 (High) and is actively exploited in the wild. CVE-2022-26500 has been added to CISA's Known Exploited Vulnerabilities catalog and is associated with ransomware campaigns, making it a high-priority patching target for organizations using Veeam's backup infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| veeam | veeam backup \& replication | >= 10.0.0.4442, < 10.0.1.4854; >= 11.0.0.825, < 11.0.1.1261; 9.5.0.1536; 9.5.4.2615; 10.0.1.4854; 11.0.1.1261 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://veeam.com(Vendor Advisory)
- https://www.veeam.com/kb4288(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26500(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Path traversal vulnerabilities occur when software uses external input to construct file paths without adequately preventing the input from resolving to locations outside the intended restricted directory. In CVE-2022-26500, the Veeam Backup & Replication distribution service fails to properly sanitize path names in API requests, allowing authenticated attackers to traverse directories and access functions that enable file upload and code execution.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
Confidentiality Impact: High — an attacker exploiting CVE-2022-26500 can access internal API functions and read files on the Veeam Backup & Replication server, potentially exposing backup data, credentials, and configuration information that could be used for further network compromise. Integrity Impact: High — the path traversal allows attackers to upload arbitrary files to the server, which can include malware, web shells, or modified system binaries. Combined with code execution capabilities, this enables complete modification of the backup infrastructure. Availability Impact: High — an attacker with code execution on the backup server can disrupt backup operations, delete or encrypt backup repositories, and render the organization unable to recover from subsequent attacks such as ransomware. Scope: Unchanged — the vulnerability is confined to the Veeam Backup & Replication server, but compromising the backup infrastructure has devastating downstream effects on the organization's ability to recover from any security incident. Attack Prerequisites: Exploitation requires network access and low-level authentication (a valid user account). No user interaction is needed, and the attack complexity is low, making it feasible for any attacker who has obtained basic credentials for the Veeam server.
Exploit Maturity
Active Exploitation: CVE-2022-26500 has been confirmed as actively exploited in the wild. Multiple threat groups have targeted Veeam Backup & Replication servers as a strategic objective in ransomware operations, aiming to destroy backup data before encrypting production systems. KEV Catalog Status: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of January 3, 2023. EPSS Score: The EPSS score of 0.24 (95th percentile) indicates a high likelihood of exploitation, reflecting the active threat landscape targeting Veeam infrastructure. Ransomware Association: CVE-2022-26500 has a confirmed association with ransomware campaigns. Ransomware operators specifically target backup servers to prevent victims from recovering their data without paying the ransom, and this vulnerability provides a direct path to compromising Veeam's backup infrastructure. Threat Landscape: Multiple ransomware groups and initial access brokers have incorporated Veeam vulnerabilities into their toolkits, recognizing that destroying an organization's backups dramatically increases the pressure to pay ransom demands.
Remediation
- Upgrade Veeam Backup & Replication to version 11a (build 11.0.1.1261 P20220302) or later, which contains the fix for CVE-2022-26500.
- If running version 9.5 or 10.x, upgrade to the latest supported version, as these branches are end-of-life and do not receive security patches for this vulnerability.
- Restrict network access to the Veeam Backup & Replication server, ensuring that only authorized administrators can reach the management interfaces and API endpoints.
- Implement strong authentication controls for Veeam Backup & Replication, including unique service accounts, strong passwords, and multi-factor authentication where possible.
- Isolate the backup infrastructure in a separate network segment to limit the impact of a compromise and prevent lateral movement from production networks.
- Monitor the Veeam server for indicators of compromise, including unexpected file uploads, unauthorized API calls, or anomalous process execution.
- Consult Veeam's knowledge base article KB4288 at https://www.veeam.com/kb4288 for detailed remediation instructions and version-specific guidance.
- Ensure compliance with CISA's remediation deadline if your organization is subject to Binding Operational Directive 22-01.
Technical Details
Vulnerability Mechanism: CVE-2022-26500 is a path traversal vulnerability in the Veeam Distribution Service, which operates on TCP port 9380 by default. The service exposes internal API functions that are intended to be accessible only within the context of authorized operations. However, improper validation of path names in API requests allows an authenticated user to traverse outside the intended directory structure and access unrestricted API endpoints. CVSS Vector Analysis: The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with a score of 8.8 reflects a network-accessible vulnerability with low complexity that requires only low-level privileges. No user interaction is needed. The High ratings for confidentiality, integrity, and availability reflect the ability to read arbitrary files, upload malicious content, and execute code on the backup server. Exploitation Pathway: An attacker who has obtained valid credentials for the Veeam Backup & Replication server sends API requests to the Veeam Distribution Service that include path traversal sequences (such as ../ patterns) in the file path parameters. These crafted paths bypass directory restrictions and allow the attacker to reach internal API functions that enable arbitrary file upload. Once a malicious file (such as a DLL or executable) is uploaded to a strategic location on the server, the attacker can trigger its execution through subsequent API calls or by leveraging Veeam's built-in functionality, achieving remote code execution. Affected Versions: Veeam Backup & Replication versions 9.5U3, 9.5U4, 10.x (all builds), and 11.x (before the P20220302 patch) are affected. The vulnerability was addressed in version 11a with build 11.0.1.1261 P20220302.
Frequently Asked Questions
What is CVE-2022-26500?
CVE-2022-26500 is a path traversal vulnerability in Veeam Backup & Replication that allows an authenticated remote attacker to access internal API functions, upload arbitrary files, and execute code on the backup server.
How severe is CVE-2022-26500?
With a CVSS score of 8.8 (High), CVE-2022-26500 is a serious vulnerability. Although it requires basic authentication, the low attack complexity and high impact across all three dimensions — confidentiality, integrity, and availability — make it a critical threat to backup infrastructure.
Is CVE-2022-26500 used in ransomware attacks?
Yes, this vulnerability has a confirmed association with ransomware campaigns. Attackers specifically target Veeam Backup & Replication servers to destroy backups before deploying ransomware, preventing victims from recovering without paying the ransom.
Which versions of Veeam are affected?
Veeam Backup & Replication versions 9.5U3, 9.5U4, 10.x (all builds), and 11.x (prior to patch P20220302) are affected. Versions 9.5 and 10.x are end-of-life and should be upgraded to the latest supported release.
How do I fix CVE-2022-26500?
Upgrade to Veeam Backup & Replication version 11a (build 11.0.1.1261 P20220302) or later. For legacy versions 9.5 and 10.x, upgrade to the latest supported branch. Additionally, restrict network access to the backup server and implement strong authentication controls.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.