Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
31 results
Oct 7, 2026This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.CVE-2026-93026 · Other software · Veeam · reported by support@hackerone.comMedium 6.1
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.
- Product
- Backup and Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.CVE-2026-58069 · Other software · Veeam · reported by support@hackerone.comHigh 8.3
This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.
- Product
- Backup and Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.CVE-2025-64393 · Other software · Veeam · reported by support@hackerone.comCritical 9.4
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
- Product
- Backup and Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.CVE-2026-32997 · Other software · Veeam · reported by support@hackerone.comHigh 8.6
A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.
- Product
- Backup and Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.CVE-2026-21672 · Other software · Veeam · reported by support@hackerone.comHigh 8.8
A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.
- Product
- Backup and Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenCVE-2025-48983 · Other software · Veeam · reported by support@hackerone.comCritical 9.9
A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.
- Product
- Backup and Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML reCVE-2025-32406 · Other software · NAKIVO · reported by MITREHigh 8.6
An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML response.
- Product
- Backup & Replication Director
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials.CVE-2024-45204 · Other software · Veeam · reported by support@hackerone.comMedium 4.3
A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials. The exploitation involves using retrieved credentials to expose sensitive NTLM hashes, impacting systems beyond the initial target and potentially leading to broader security vulnerabilities.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a rCVE-2024-42457 · Other software · Veeam · reported by support@hackerone.comMedium 6.5
A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading to the leak of plaintext credentials to a malicious host. The attack is facilitated by improper usage of a method that allows operators to add a new host with an attacker-controlled IP, enabling them to retrieve sensitive credentials in plaintext.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configurationCVE-2024-42456 · Other software · Veeam · reported by support@hackerone.comHigh 8.8
A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuration settings, such as modifying the trusted client certificate used for authentication on a specific port. This can result in unauthorized access, enabling the user to call privileged methods and initiate critical services. The issue arises due to insufficient permission requirements on the method, allowing users with low privileges to perform actions that should require higher-level permissions.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serCVE-2024-42455 · Other software · Veeam · reported by support@hackerone.comHigh 8.1
A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. This exploit allows the attacker to delete any file on the system with service account privileges. The vulnerability is caused by an insufficient blacklist during the deserialization process.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts.CVE-2024-42453 · Other software · Veeam · reported by support@hackerone.comHigh 8.1
A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability to power off virtual machines, delete files in storage, and make configuration changes, potentially leading to Denial of Service (DoS) and data integrity issues. The vulnerability is caused by improper permission checks in methods accessed via management services.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escalatCVE-2024-42452 · Other software · Veeam · reported by support@hackerone.comHigh 8.8
A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escalating privileges to system-level access. This allows the attacker to upload files to the server with elevated privileges. The vulnerability exists because remote calls bypass permission checks, leading to full system compromise.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext.CVE-2024-42451 · Other software · Veeam · reported by support@hackerone.comMedium 6.5
A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by calling a series of methods over an external protocol, ultimately retrieving the credentials using a malicious setup on the attacker's side. This exposes sensitive data, which could be used for further attacks, including unauthorized access to systems managed by the platform.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs.CVE-2024-40717 · Other software · Veeam · reported by support@hackerone.comHigh 8.8
A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share and are executed with elevated privileges by default. The user can update a job and schedule it to run almost immediately, allowing arbitrary code execution on the server.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass.CVE-2024-40715 · Other software · Veeam · reported by support@hackerone.comHigh 7.7
A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Attackers must be able to perform Man-in-the-Middle (MITM) attack to exploit this vulnerability.
- Product
- Enterprise Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2024A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settCVE-2024-40713 · Other software · Veeam · reported by support@hackerone.comHigh 7.8
A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA.
- Product
- Backup and Recovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2024Veeam Backup and Replication Deserialization VulnerabilityCVE-2024-40711 · Other software · Veeam · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
- Product
- Backup & Replication
- On CISA’s list since
- Oct 17, 2024 (federal fix deadline Nov 7, 2024)
- What to do
- Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogveeam.comlabs.watchtowr.com
May 22, 2024Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.CVE-2024-29852 · Other software · Veeam · reported by support@hackerone.comLow 2.7
Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2024Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.CVE-2024-29851 · Other software · Veeam · reported by support@hackerone.comHigh 7.2
Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2024Veeam Backup Enterprise Manager allows account takeover via NTLM relay.CVE-2024-29850 · Other software · Veeam · reported by support@hackerone.comHigh 8.8
Veeam Backup Enterprise Manager allows account takeover via NTLM relay.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2024Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.CVE-2024-29849 · Other software · Veeam · reported by support@hackerone.comCritical 9.8
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function VulnerabilityCVE-2023-27532 · Other software · Veeam · reported by support@hackerone.comExploitedRansomwareHigh 7.5
Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.
- Product
- Backup & Replication
- On CISA’s list since
- Aug 22, 2023 (federal fix deadline Sep 12, 2023)
- What to do
- Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogveeam.comveeam.com
Mar 17, 2022Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) alloCVE-2022-26504 · Other software · Veeam · reported by MITREHigh 8.8
Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe
- Product
- Veeam Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Veeam Backup & Replication Remote Code Execution VulnerabilityCVE-2022-26501 · Other software · Veeam · reported by MITREExploitedRansomwareCritical 9.8
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
- Product
- Backup & Replication
- On CISA’s list since
- Dec 13, 2022 (federal fix deadline Jan 3, 2023)
- What to do
- Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogveeam.comveeam.com
Mar 17, 2022Veeam Backup & Replication Remote Code Execution VulnerabilityCVE-2022-26500 · Other software · Veeam · reported by MITREExploitedRansomwareHigh 8.8
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
- Product
- Backup & Replication
- On CISA’s list since
- Dec 13, 2022 (federal fix deadline Jan 3, 2023)
- What to do
- Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogveeam.comveeam.com
Jun 30, 2021Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting.CVE-2021-35971 · Other software · Veeam · reported by MITRECritical 9.8
Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting.
- Product
- Veeam Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2020Lack of access control in Nakivo Backup & Replication Transporter version 9.4.0.r43656 allows remote users to access unencrypted backup repositories and the NakCVE-2020-15851 · Other software · Nakivo · reported by MITRECritical 9.8
Lack of access control in Nakivo Backup & Replication Transporter version 9.4.0.r43656 allows remote users to access unencrypted backup repositories and the Nakivo Controller configuration via a network accessible transporter service. It is also possible to create or delete backup repositories.
- Product
- Backup & Replication Transporter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.nakivo.comlabs.f-secure.com
Sep 24, 2020Insecure permissions in Nakivo Backup & Replication Director version 9.4.0.r43656 on Linux allow local users to access the Nakivo Director web interface and gaiCVE-2020-15850 · Other software · Nakivo · reported by MITREHigh 7.8
Insecure permissions in Nakivo Backup & Replication Director version 9.4.0.r43656 on Linux allow local users to access the Nakivo Director web interface and gain root privileges. This occurs because the database containing the users of the web application and the password-recovery secret value is readable.
- Product
- Backup & Replication Director
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.nakivo.comlabs.f-secure.com
Jul 3, 2020VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achievCVE-2020-15518 · Other software · Veeam · reported by MITREHigh 8.8
VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control over filesystem I/O requests.
- Product
- Veeam Availability Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzwclose.github.iozwclose.github.io
Oct 16, 2015VeeamVixProxy in Veeam Backup & Replication (B&R) before 8.0 update 3 stores local administrator credentials in log files with world-readable permissions, whichCVE-2015-5742 · Other software · Veeam · reported by MITRELow 2.1
VeeamVixProxy in Veeam Backup & Replication (B&R) before 8.0 update 3 stores local administrator credentials in log files with world-readable permissions, which allows local users to obtain sensitive information by reading the files.
- Product
- Veeam Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.