Veeam Backup & Replication Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 13/12/2022. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| veeam backup & replication | = 10.0.1.4854= 11.0.1.1261= 9.5.0.1536= 9.5.4.2615≥ 10.0.0.4442, < 10.0.1.4854≥ 11.0.0.825, < 11.0.1.1261 | 10.0.1.485411.0.1.1261 |
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free