CVE-2022-26501
Veeam Backup & Replication Remote Code Execution Vulnerability
Description
CVE-2022-26501 is a critical incorrect access control vulnerability in Veeam Backup & Replication versions 10.x and 11.x. This missing authentication flaw allows an unauthenticated remote attacker to gain unauthorized access to the Veeam Backup & Replication system, potentially achieving full control over backup infrastructure including the ability to read, modify, or delete backup data. With a CVSS score of 9.8 (Critical) and an EPSS score of 66.7%, CVE-2022-26501 poses an extremely high risk to affected environments. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog and has confirmed its use in ransomware campaigns, making immediate remediation essential for any organization running vulnerable Veeam Backup & Replication versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| veeam | veeam backup \& replication | >= 10.0.0.4442, < 10.0.1.4854; >= 11.0.0.825, < 11.0.1.1261; 10.0.1.4854; 11.0.1.1261 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://veeam.com(Vendor Advisory)
- https://www.veeam.com/kb4288(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26501(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
Veeam Backup & Replication versions 10.x and 11.x fail to properly enforce authentication on critical management functions, allowing unauthenticated attackers to interact with sensitive backup operations. This missing authentication weakness means that network-accessible endpoints in Veeam Backup & Replication can be reached without valid credentials, enabling full system compromise.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2022-26501 is remotely exploitable without physical access, requires no authentication, and demands no user interaction, making it trivially exploitable by any attacker who can reach the Veeam Backup & Replication service over the network. The attack complexity is low, meaning no special conditions or preparation are needed to exploit this vulnerability. Confidentiality (High): An attacker can access all backup data managed by the Veeam instance, potentially including sensitive corporate files, databases, and credentials stored in backups. Integrity (High): The attacker can modify or corrupt backup data, undermining disaster recovery capabilities. Availability (High): Backup operations can be disrupted entirely, and backup data can be deleted or encrypted. With a CVSS score of 9.8 (Critical) and an EPSS score of 66.7% indicating a high likelihood of exploitation, this vulnerability is particularly dangerous because it has been confirmed in ransomware attacks, where threat actors specifically target backup infrastructure to prevent recovery.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-26501 in the wild and has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of January 3, 2023. Notably, this vulnerability has been associated with known ransomware campaigns, where attackers target Veeam Backup & Replication to destroy or encrypt backup data before deploying ransomware on production systems. The EPSS score of 66.7% (98th percentile) indicates a very high probability of exploitation activity, consistent with the observed ransomware usage.
Remediation
- Apply Veeam security patches immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Refer to Veeam KB4288 for detailed patch instructions and upgrade to a fixed version of Veeam Backup & Replication.
- Upgrade Veeam Backup & Replication beyond the affected 10.x and 11.x versions to a patched release that addresses CVE-2022-26501. Consult the Veeam release notes for the specific fixed version numbers.
- Restrict network access to the Veeam Backup & Replication management interfaces using firewall rules and network segmentation. Ensure that only authorized management hosts can reach the Veeam service ports, and isolate the backup infrastructure from general network access.
- Monitor for indicators of compromise by reviewing Veeam Backup & Replication logs for unexpected access attempts, unauthorized backup job modifications, or unusual authentication patterns. Given the ransomware association, check for signs of backup deletion or encryption attempts.
- Implement strong authentication controls across all backup infrastructure components, including multi-factor authentication for administrative access, and regularly audit access permissions to ensure only authorized personnel can manage backup operations.
Technical Details
CVE-2022-26501 stems from a missing authentication for critical function (CWE-306) weakness in Veeam Backup & Replication versions 10.x and 11.x. The vulnerability allows unauthenticated attackers to access critical management functions within the Veeam platform without providing valid credentials. As reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the attack can be conducted remotely over the network with low complexity, requires no privileges or user interaction, and results in complete compromise of confidentiality, integrity, and availability. The incorrect access control mechanism fails to validate authentication tokens or session credentials on sensitive API endpoints, allowing attackers to issue administrative commands directly to the backup server. This is categorized as issue 1 of 2, indicating a related vulnerability also exists in the same product versions.
Frequently Asked Questions
Is CVE-2022-26501 being actively exploited?
Yes, CVE-2022-26501 is being actively exploited in the wild. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of January 3, 2023. This vulnerability has been confirmed in ransomware campaigns targeting backup infrastructure.
What products are affected by CVE-2022-26501?
CVE-2022-26501 affects Veeam Backup & Replication versions 10.x and 11.x. Organizations running these versions should treat remediation as an urgent priority given the confirmed ransomware exploitation.
How do I fix CVE-2022-26501?
Apply the security patch referenced in Veeam KB4288 or upgrade to a fixed version of Veeam Backup & Replication. Additionally, restrict network access to management interfaces and implement network segmentation to limit exposure. See the Remediation section for detailed steps.
How severe is CVE-2022-26501?
CVE-2022-26501 is rated Critical with a CVSS score of 9.8 out of 10. Its EPSS score of 66.7% places it in the 98th percentile, indicating very high exploitation probability. The confirmed ransomware usage further elevates the urgency of this vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.