PT-2022-1828 · Veeam · Veeam Backup & Replication

Nikita Petrov · Published 2022-03-12 · Updated 2025-11-03 · CVE-2022-26500

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication versions 9.5U3 through 9.5U4, 10.x, and 11.x

Description An improper limitation of path names allows remote authenticated users to access internal API functions. This access could allow attackers to upload and execute arbitrary code. The issue is related to the Distribution Service and involves deficiencies in access control. Exploitation occurs through the TCP port 9380. The vulnerability allows attackers to upload specially crafted data.

Recommendations Veeam Backup & Replication versions 9.5U3 through 9.5U4 should be updated. Veeam Backup & Replication 10.x should be updated. Veeam Backup & Replication 11.x should be updated.

Fix

Improper Privilege Management

Path traversal

Weakness Enumeration

CWE-269

CWE-22

CWE-264

Related Identifiers

BDU:2022-01267

CVE-2022-26500

Affected Products

Veeam Backup & Replication

References · 29

• https://bdu.fstec.ru/vul/2022-01267 · Security Note
• https://veeam.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26500 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26500 · Vendor Advisory
• https://t.me/rnetsec/16562 · Telegram Post
• https://twitter.com/DefusedCyber/status/1975144933624279229 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1np86p5/top_10_trending_cves_24092025 · Reddit Post
• https://twitter.com/DefusedCyber/status/1970101003094470987 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26500 · Note
• https://t.me/secharvester/12154 · Telegram Post
• https://t.me/cveNotify/141328 · Telegram Post
• https://t.me/cvenotify/117634 · Telegram Post
• https://t.me/cvenotify/79683 · Telegram Post
• https://t.me/cvenotify/43504 · Telegram Post
• https://t.me/ptswarm/115 · Telegram Post