CVE-2022-26500
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
51Vexday Risk Score
Prioritize patching. It under exploitation confirmed by CISA.
ssvc Actcvss 8.8epss 5.8%
from disclosure to weapon
Published on NVDMar 17
CISA KEV+271d
Action required by CISAfederal deadline: 2023-01-03
Apply updates per vendor instructions.
In short
A security flaw in Veeam Backup & Replication allows authenticated users to bypass path restrictions and access internal API functions, enabling them to upload and run malicious code on the system.
Technical detail
Improper path validation (CWE-22) in Veeam Backup & Replication 9.5U3-U4, 10.x, and 11.x permits authenticated remote attackers to circumvent access controls on internal API endpoints, facilitating arbitrary code upload and execution with elevated privileges.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a