CISA KEV · Known exploitedCritical

CVE-2022-26501

Veeam Backup & Replication

Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

PRIORITY ASSESSMENT

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability4.28%

Technical severityCVSS 9.8

Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

Product: Veeam Backup & Replication
Affected versions: >= 10.0.0.4442 < 10.0.1.4854, >= 11.0.0.825 < 11.0.1.1261, 10.0.1.4854, 11.0.1.1261
Fixed versions: 10.0.1.4854, 11.0.1.1261

Confirm exposure before applying a vendor-supported change.

CISA required action

Apply updates per vendor instructions.

Due date: 2023.01.03

1
Identify
Confirm that Veeam Backup & Replication and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.