CVE-2023-27532

What it actually does

CVE-2023-27532 is a missing-authentication vulnerability in Veeam Backup & Replication that allows a network-accessible, unauthenticated attacker to retrieve encrypted credentials stored in the Veeam configuration database. Those credentials commonly include accounts used to access backup repositories, Windows or Linux servers, hypervisors, cloud targets, and other backup infrastructure components. The primary impact is high confidentiality loss, with secondary risk of privilege escalation and lateral movement if the exposed credentials can be decrypted, reused, or leveraged through existing trust relationships.

Why it matters to the business

Compromise of backup infrastructure can undermine an organization’s ability to recover from outages or ransomware because attackers may obtain privileged credentials, access backup servers and repositories, and potentially disable, delete, or tamper with backups. This issue is listed in CISA KEV, has been observed in active exploitation, and is associated with ransomware activity, making it a high-priority remediation item even though the CVSS score is 7.5. Because Veeam Backup & Replication is widely deployed in enterprise recovery operations, exposed systems represent a significant operational resilience risk.

How an attack unfolds

An attacker first identifies a Veeam Backup & Replication server or Cloud Connect component reachable over the network, especially the Veeam Backup Service interface. If the vulnerable service is accessible, the attacker sends unauthenticated requests that trigger the vulnerable function and cause credential records from the Veeam configuration database to be returned. The attacker then attempts to decrypt or reuse the recovered credential material, focusing on accounts with access to backup repositories, virtualization platforms, domain resources, cloud storage, or managed servers. With valid credentials, the attacker can pivot into backup infrastructure, enumerate recovery assets, access stored backups, and in ransomware scenarios attempt to delete, encrypt, or prevent restoration from backups before launching broader destructive activity.

How to fix it

Upgrade Veeam Backup & Replication to a vendor-fixed build immediately. Known fixed releases include Veeam Backup & Replication 12 build 12.0.0.1420 P20230223 or later, and Veeam Backup & Replication 11a build 11.0.1.1261 P20230227 or later. If direct upgrade is not immediately possible, restrict access to Veeam Backup & Replication management and service ports to only trusted backup administrators, backup proxies, repositories, and required infrastructure components. Do not expose Veeam Backup & Replication services to the internet. Rotate credentials stored in Veeam after patching, prioritizing domain, local administrator, hypervisor, repository, cloud, and service accounts. Review service account privileges and reduce them to the minimum required. Where feasible, isolate backup infrastructure in a dedicated management network and enforce MFA and privileged access controls for administrative access.

How to confirm the fix worked

Confirm the installed Veeam Backup & Replication build is at or above a fixed version by checking the Veeam console, installed program details, or file version information for Veeam components. Validate that TCP port 9401 and other Veeam management/service ports are reachable only from authorized systems and are not exposed to untrusted networks or the internet. Perform authenticated configuration review to verify that stored credentials have been rotated after patching. Review firewall rules, ACLs, and segmentation controls around backup servers, repositories, proxies, and Cloud Connect components. Use vulnerability scanning or vendor-supported checks to confirm the vulnerability is no longer reported, avoiding unsafe public credential-dump proof-of-concept tools in production.

Typical attack path

1. Discover an exposed Veeam Backup & Replication or Cloud Connect server on an internal network, VPN-accessible segment, or the internet.
2. Connect to the Veeam Backup Service interface, commonly associated with TCP port 9401, without valid authentication.
3. Invoke the vulnerable functionality to retrieve encrypted credential records from the Veeam configuration database.
4. Process the recovered credential material and attempt decryption, offline analysis, or direct reuse against related infrastructure.
5. Use valid credentials to access backup repositories, hypervisors, Windows or Linux hosts, storage systems, or cloud backup targets.
6. Escalate access by abusing privileged backup service accounts or accounts with broad infrastructure permissions.
7. Manipulate, delete, exfiltrate, or disable backups to weaken recovery capability, often as preparation for ransomware deployment.

How to detect it

Investigate whether untrusted systems connected to Veeam Backup & Replication services, particularly TCP/9401, before patching. Review network telemetry, firewall logs, EDR network events, Windows Security logs, and Veeam application logs for unexpected inbound connections to the Veeam Backup Service from workstations, VPN clients, internet addresses, or non-backup infrastructure. Examine Windows Security Event ID 4624 logon type 3 events and remote service activity involving accounts stored in Veeam, especially shortly after suspicious connections to the Veeam server. Review Veeam logs for unusual credential, configuration database, repository, or backup-management activity. Hunt for post-exploitation behavior such as successful authentication to backup repositories, hypervisors, storage systems, or cloud targets using Veeam-managed credentials; backup deletion or retention-policy changes; disabled jobs; repository browsing; suspicious restores; or ransomware staging. Because exploitation may only retrieve credentials and leave limited application-layer artifacts, correlate network access to the Veeam service with subsequent credential use across the environment.

• TCP/9401
• Veeam.Backup.Service.exe
• C:\ProgramData\Veeam\Backup\Svc.VeeamBackup.log
• C:\ProgramData\Veeam\Backup\VeeamBackup.log
• C:\ProgramData\Veeam\Backup\VeeamShell.log
• Event ID 4624 Logon Type 3
• auxiliary/gather/veeam_credential_dump
• veeam_credential_dump

What your security team should do

• Treat this as urgent because it is in CISA KEV, has active exploitation, and is associated with ransomware activity; remediate any remaining exposure immediately.
• Upgrade all affected Veeam Backup & Replication instances to a fixed build or later, including standby, lab, disaster recovery, and Cloud Connect deployments.
• Restrict network access to Veeam service ports, especially TCP/9401, to explicitly authorized systems only.
• After patching, rotate all credentials stored in Veeam, prioritizing privileged accounts and accounts used for repositories, hypervisors, domain resources, and cloud targets.
• Hunt for historical connections to Veeam Backup Service from unusual sources, especially before patching or around suspicious authentication activity.
• Review Veeam administrative activity, backup job changes, repository access, backup deletion events, and failed or unusual restore/delete operations.
• Audit backup service account permissions and remove unnecessary domain administrator, local administrator, hypervisor administrator, or broad storage privileges.
• Ensure immutable or offline backups are configured and confirm restore procedures remain functional.
• Monitor for follow-on use of credentials that were stored in Veeam, including lateral movement to virtualization, storage, cloud, and Windows/Linux infrastructure.