CVE-2022-26501

What it actually does

Veeam Backup & Replication 10.x and 11.x contains an incorrect access control flaw that can allow a network-reachable, unauthenticated attacker to bypass expected authorization checks against Veeam service interfaces. Successful exploitation can give the attacker control over privileged backup service functionality and may lead to remote code execution or full compromise of the backup server, with high impact to confidentiality, integrity, and availability. Because Veeam servers commonly run with elevated privileges and have access to backup repositories, credentials, restore points, and connected infrastructure, compromise of this component can become a high-value pivot point.

Why it matters to the business

This is a high-severity, remotely exploitable issue in backup infrastructure and is listed in CISA KEV with known ransomware use; the CISA remediation deadline was 2023-01-03, so any remaining exposure should be treated as overdue and urgent. A successful attack can undermine the organization’s ability to recover from incidents by deleting, encrypting, corrupting, or exfiltrating backups, and can also provide attackers with credentials or administrative footholds for broader compromise. Operational consequences may include prolonged outage, failed disaster recovery, ransomware escalation, regulatory exposure from data theft, and higher recovery cost.

How an attack unfolds

An attacker first identifies an internet-exposed or internally reachable Veeam Backup & Replication server running an affected 10.x or 11.x version. Because the flaw is remotely reachable, low complexity, and requires no user interaction or prior authentication, the attacker can interact directly with vulnerable Veeam service endpoints and bypass the intended access control checks. After successful abuse, the attacker can execute privileged actions through the Veeam service context, which may include running code, manipulating backup jobs, accessing backup metadata, harvesting stored credentials, or staging additional tools. In ransomware intrusions, attackers commonly use this access to disable backup jobs, remove or encrypt restore points, destroy repositories, and then deploy ransomware across the environment to maximize pressure on the victim.

How to fix it

Upgrade affected Veeam Backup & Replication 10.x and 11.x deployments to a vendor-supported fixed release immediately. If exact fixed package versions are not available in the asset inventory, validate against the latest Veeam security advisories and install the applicable cumulative patch or current supported release for the deployed major version. Remove direct internet exposure for Veeam services and restrict access to management interfaces using firewalls, VPNs, and administrative network segmentation. Limit access to Veeam management ports to trusted backup administrators and required infrastructure only. Rotate credentials stored in or used by Veeam after patching if compromise is suspected. Review backup repository immutability, offline copies, and least-privilege service account configuration. If exploitation is possible or suspected, perform incident response before assuming backups are trustworthy.

How to confirm the fix worked

Confirm the installed Veeam Backup & Replication version and build from the Veeam console, installed programs inventory, or executable metadata, and verify it is no longer an affected 10.x or 11.x build without the vendor fix. Validate that Veeam management and service ports are not reachable from the internet or untrusted network segments. Run authenticated vulnerability scans or configuration checks against backup servers to confirm the flaw is no longer reported. Review firewall rules to ensure only approved administrative hosts can reach Veeam service interfaces. Confirm Veeam services restart successfully after patching and that backup, restore, and repository integrity checks complete successfully. Where exploitation is suspected, validate that restore points are intact, immutable backups remain protected, backup jobs have not been tampered with, and Veeam-stored credentials have been rotated.

Typical attack path

1. Scan for Veeam Backup & Replication servers or Veeam management ports exposed to untrusted networks.
2. Fingerprint the Veeam version to identify affected 10.x or 11.x installations.
3. Send crafted requests to vulnerable Veeam service interfaces to bypass authorization checks.
4. Obtain privileged execution or control through the Veeam backup service context.
5. Enumerate backup jobs, repositories, stored credentials, restore points, and connected infrastructure.
6. Disable backup jobs, delete or corrupt restore points, or exfiltrate backup data.
7. Use the compromised backup server as a pivot to deploy tools, move laterally, or support ransomware execution.
8. Cover tracks by clearing logs, stopping Veeam services, or deleting forensic artifacts.

How to detect it

Investigate whether affected Veeam servers were reachable from untrusted networks before patching and review Veeam, Windows, EDR, and network telemetry for signs of unauthorized service interaction or post-exploitation. Key log sources include Veeam logs under C:\ProgramData\Veeam\Backup\, Windows Security logs for logon and privilege events, Windows System logs for service installation or service failures, PowerShell logs, EDR process telemetry, firewall logs, VPN logs, and repository access logs. Look for connections to Veeam service ports from unfamiliar internal or external IP addresses; Veeam service crashes or restarts; suspicious child processes launched by Veeam.Backup.Service.exe or related Veeam services; creation of new local administrators; credential dumping tools; backup job disablement; deletion of restore points; mass repository file modification; and attempts to clear logs. For ransomware-related activity, specifically review whether backup jobs were disabled shortly before encryption, repositories became inaccessible, restore points were deleted, or Veeam services were stopped outside approved change windows. Absence of a single known exploit string does not prove safety; use behavioral hunting focused on Veeam service misuse and backup tampering.

• C:\ProgramData\Veeam\Backup\
• C:\ProgramData\Veeam\Backup\Svc.VeeamBackup.log
• C:\ProgramData\Veeam\Backup\Svc.VeeamBroker.log
• C:\ProgramData\Veeam\Backup\Svc.VeeamCatalog.log
• C:\ProgramData\Veeam\Backup\Svc.VeeamInstallerSvc.log
• Veeam.Backup.Service.exe
• Veeam.Backup.Manager.exe
• VeeamDeploymentSvc.exe
• Veeam.Backup.CatalogDataService.exe
• Veeam.Backup.ProxyService.exe
• VeeamBackupSvc
• VeeamDeploySvc
• VeeamTransportSvc
• TCP/9392
• TCP/9393
• TCP/9401
• TCP/2500
• TCP/3300
• Event ID 7045
• Event ID 4624
• Event ID 4672
• Event ID 4688
• Event ID 4104
• powershell.exe -enc
• cmd.exe /c
• rundll32.exe
• regsvr32.exe
• mshta.exe
• certutil.exe -urlcache
• bitsadmin.exe
• vssadmin.exe delete shadows
• wbadmin delete catalog
• wevtutil cl
• bcdedit /set {default} recoveryenabled no

What your security team should do

• Treat any unpatched affected Veeam Backup & Replication 10.x or 11.x server as urgent because the vulnerability is in CISA KEV and has been used in ransomware campaigns.
• Patch or upgrade all affected Veeam servers before performing routine maintenance work; this is an overdue KEV item with a 2023-01-03 remediation deadline.
• Immediately remove internet exposure and restrict Veeam service access to trusted administrative networks only.
• Hunt for exploitation on Veeam servers, especially suspicious child processes spawned by Veeam services, unauthorized backup job changes, deleted restore points, and unusual repository access.
• Rotate Veeam-managed credentials, service account passwords, and credentials stored in backup infrastructure if compromise cannot be ruled out.
• Enable or verify immutable, offline, or air-gapped backup copies so attackers cannot destroy all recovery options through the Veeam server.
• Review Veeam logs, Windows event logs, EDR telemetry, and firewall logs for activity before and after the patch date.
• Prioritize forensic preservation of Veeam logs and repository metadata before rebuilding or cleaning systems suspected of compromise.