Veeam vulnerabilities

CVEs per yearBy the year they were published

1. 20204
2. 20234
3. 202440
4. 20259
5. 202650

Known exploitedNewest addition to KEV first

• CVE-2024-40711

  A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

  Veeam · Backup and Recovery

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-107238

  A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management…

  Veeam · Management Pack for Microsoft System Center

  High8.7
• CVE-2026-107239

  A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam…

  Veeam · Management Pack for Microsoft System Center

  High8.8
• CVE-2023-22793

  A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of…

  Veeam · Management Pack for Microsoft System Center

  Critical9.3
• CVE-2025-64394

  A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365,…

  Veeam · Backup for Microsoft 365

  Medium4.3
• CVE-2026-108141

  A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write…

  Veeam · Backup and Replication

  Medium5.9
• CVE-2026-106078

  A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API…

  Veeam · Backup for Microsoft 365

  Medium6.9
• CVE-2026-107671

  A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA…

  Veeam · ONE

  High8.5
• CVE-2026-108142

  A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

  Veeam · Backup and Replication

  Critical9.1
• CVE-2026-106077

  A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem…

  Veeam · Backup for Microsoft 365

  High8.3
• CVE-2026-106076

  A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365…

  Veeam · Backup for Microsoft 365

  Critical9.0