CVE-2022-26500

What it actually does

CVE-2022-26500 is a path-name limitation flaw in Veeam Backup & Replication that allows a remote authenticated user to reach internal API functionality that should not be exposed. By abusing the path handling weakness, an attacker can upload attacker-controlled files and cause arbitrary code execution on the Veeam Backup & Replication server. Because the backup server commonly has high-value credentials, access to backup repositories, and administrative reach into virtualization and Windows infrastructure, successful exploitation can lead to full confidentiality, integrity, and availability compromise of the backup platform and connected systems.

Why it matters to the business

A compromised Veeam Backup & Replication server can undermine an organization’s ability to recover from incidents, expose backed-up data, and provide attackers with a powerful foothold for lateral movement or ransomware deployment. This vulnerability is listed in CISA KEV, has known in-the-wild exploitation, and is associated with ransomware activity, making it a high-priority remediation item even though authentication is required. The CISA KEV remediation deadline was 2023-01-03, so any remaining exposure should be treated as overdue and urgent.

How an attack unfolds

An attacker first obtains valid credentials for Veeam Backup & Replication or an account able to authenticate to the vulnerable service. They then connect remotely to the Veeam Backup & Replication management/API service and submit crafted requests that abuse improper path-name handling to access internal API functions. Through those internal functions, the attacker uploads a malicious payload or script to a location where it can be executed by the Veeam service context. Once execution is achieved, the attacker can run commands on the backup server, harvest credentials or configuration data, tamper with backup jobs and repositories, disable or delete backups, and stage ransomware or additional tooling. Because this issue is known to be exploited in the wild and tied to ransomware activity, post-exploitation should be assumed to focus on disabling recovery options and expanding access.

How to fix it

Upgrade Veeam Backup & Replication to a vendor-supported fixed release immediately. Versions 9.5U3, 9.5U4, 10.x, and 11.x are affected; unsupported 9.5 deployments should be upgraded rather than patched in place. Where immediate upgrade is not possible, restrict access to Veeam management and API services to dedicated administration hosts or VPN segments, block untrusted network access to Veeam service ports, remove unnecessary Veeam user access, enforce MFA for administrative access where supported, and monitor for anomalous authenticated activity. Because exploitation can result in arbitrary code execution, systems that were exposed before patching should be reviewed for compromise rather than treated as clean solely because they were upgraded.

How to confirm the fix worked

Confirm the installed Veeam Backup & Replication build is a vendor-supported fixed version and that no affected 9.5U3, 9.5U4, 10.x, or 11.x build remains in production. Validate from the Veeam console, installed product inventory, software management tooling, or the Windows installed-programs registry entries. Confirm Veeam management/API services are reachable only from approved administrative networks. Review firewall rules and external exposure scans to ensure Veeam services are not reachable from the internet or broad user networks. After remediation, test that normal backup, restore, and repository access functions still work, and review recent Veeam logs for suspicious upload, internal API, path traversal, or unexpected process execution activity.

Typical attack path

1. Acquire or reuse valid credentials for Veeam Backup & Replication or a privileged Windows/domain account with access to the service.
2. Identify an exposed vulnerable Veeam Backup & Replication service on the network.
3. Authenticate to the Veeam service remotely.
4. Send crafted path-manipulation requests that reach internal API functions not intended for external use.
5. Upload an attacker-controlled executable, script, DLL, or other payload.
6. Trigger execution of the uploaded payload through the vulnerable internal API path.
7. Use the Veeam server’s privileges to access backup repositories, configuration data, stored credentials, and connected infrastructure.
8. Disable, corrupt, encrypt, or delete backups to reduce recovery options.
9. Move laterally or deploy ransomware across the environment.

How to detect it

Review Veeam Backup & Replication server logs, Windows Security logs, PowerShell logs, Sysmon/EDR telemetry, firewall logs, and authentication logs for activity before and after patching. Focus on authenticated access to Veeam services followed by unusual file creation, upload activity, path traversal patterns, unexpected execution by Veeam service processes, creation of new local users, credential dumping, backup job deletion, repository tampering, or mass backup removal. Examine Veeam logs under ProgramData for errors or requests containing relative path sequences, unexpected internal API references, file uploads, or execution activity. In Windows logs, look for process creation events where Veeam service processes spawn command interpreters, scripting engines, archive tools, network utilities, or unknown executables. Because this vulnerability is associated with ransomware activity, also look for pre-ransomware behaviors such as disabling services, deleting shadow copies, stopping backup jobs, removing restore points, and accessing backup repositories outside normal job schedules.

• C:\ProgramData\Veeam\Backup\
• C:\ProgramData\Veeam\Backup\Svc.VeeamBackup.log
• C:\ProgramData\Veeam\Backup\Veeam.Backup.Service.log
• ..\
• ../
• Veeam.Backup.Service.exe
• Veeam.Backup.Manager.exe
• Veeam.Backup.Shell.exe
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -ExecutionPolicy Bypass
• wscript.exe
• cscript.exe
• rundll32.exe
• regsvr32.exe
• certutil.exe -urlcache
• bitsadmin /transfer
• vssadmin.exe Delete Shadows
• wbadmin delete catalog
• wevtutil cl
• net user /add
• net localgroup administrators
• Stop-Service Veeam
• sc stop Veeam
• Remove-VBRBackup
• Disable-VBRJob

What your security team should do

• Treat this as urgent because it is in CISA KEV, has active in-the-wild exploitation, and is associated with ransomware activity.
• Patch or upgrade all affected Veeam Backup & Replication servers immediately; prioritize any server reachable from broad internal networks, VPN users, or the internet.
• If patching is delayed, isolate Veeam services to a restricted management network and allow access only from approved administrative hosts.
• Audit Veeam users, Windows local administrators, domain accounts, and service accounts with access to the Veeam server; remove unnecessary privileges and rotate credentials if compromise is suspected.
• Hunt for signs of arbitrary file upload, path traversal, suspicious internal API access, unexpected child processes from Veeam services, and changes to backup jobs or repositories.
• Verify backup integrity, immutability settings, offline copies, and restore capability; ensure attackers have not deleted, encrypted, or poisoned recovery points.
• Review endpoint telemetry on Veeam servers for suspicious payloads, web shells, remote administration tools, credential dumping tools, and ransomware staging.
• If exploitation is suspected, isolate the Veeam server, preserve forensic evidence, rotate credentials stored or used by Veeam, and investigate connected virtualization, Windows, and repository infrastructure.