Evil-DB LogoEvil-DB
← All CVEs

CVE-2022-26501

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2022-12-13Remediation due 2023-01-03

Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

9.8
CVSS
4.1%
EPSS (exploit prob.)
90th
EPSS percentile
2022-03-17
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-306

Affected products

VendorProductAffected versions
veeamveeam_backup_&_replication>= 10.0.0.4442, < 10.0.1.4854
veeamveeam_backup_&_replication>= 11.0.0.825, < 11.0.1.1261
veeamveeam_backup_&_replication10.0.1.4854
veeamveeam_backup_&_replication10.0.1.4854
veeamveeam_backup_&_replication10.0.1.4854
veeamveeam_backup_&_replication11.0.1.1261
veeamveeam_backup_&_replication11.0.1.1261
veeamveeam_backup_&_replication11.0.1.1261

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-26501