Advisories · Technology

Veeam Backup and Recovery.

Every CVE that names Veeam Backup and Recovery among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-59468 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Command injection in Veeam Backup and Recovery
- Veeam Backup and Recovery
- Command injection
Not analysed yet 8 Jan 2026
CVE-2025-55125 CVE record

CVSS 7.8 High

Command injection in Veeam Backup And Recovery
- Veeam Backup And Recovery
- Command injection
Not analysed yet 8 Jan 2026
CVE-2025-59469 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Information disclosure in Veeam Backup and Recovery
- Veeam Backup and Recovery
- Information disclosure
Not analysed yet 8 Jan 2026
CVE-2025-59470 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Command injection in Veeam Backup and Recovery
- Veeam Backup and Recovery
- Command injection
Not analysed yet 8 Jan 2026
CVE-2025-24286 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

Improper privilege management in Veeam Backup and Recovery
- Veeam Backup and Recovery
- Privilege escalation
Not analysed yet 18 Jun 2025
CVE-2025-23121 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Code injection in Veeam Backup and Recovery
- Veeam Backup and Recovery
- Code injection
Not analysed yet 18 Jun 2025
CVE-2025-23120 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Deserialization of untrusted data in Veeam Backup and Recovery
- Veeam Backup and Recovery
- Insecure deserialization
Not analysed yet 20 Mar 2025
CVE-2024-40714 CVE record

CVSS 8.3 High

Improper certificate validation in Veeam Backup and Recovery
- Veeam Backup and Recovery
- Weak cryptography or TLS
Not analysed yet 7 Sept 2024
CVE-2024-40713 CVE record

CVSS 7.8 High

Improper authentication in Veeam Backup and Recovery
- Veeam Backup and Recovery
- Authentication bypass
Not analysed yet 7 Sept 2024
CVE-2024-40709 CVE record

CVSS 7.8 High

Missing authorization in Veeam Backup and Recovery
- Veeam Backup and Recovery
- Broken access control
Not analysed yet 7 Sept 2024
CVE-2024-40711 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Deserialization of untrusted data in Veeam Backup and Recovery
- Veeam Backup and Recovery
- Insecure deserialization
Not analysed yet 7 Sept 2024
CVE-2024-40712 CVE record

CVSS 7.8 High

Path traversal in Veeam Backup and Recovery
- Veeam Backup and Recovery
- Path traversal
Not analysed yet 7 Sept 2024
CVE-2024-40710 CVE record

CVSS 8.8 High

Insufficiently protected credentials in Veeam Backup and Recovery
- Veeam Backup and Recovery
- Hard-coded credentials
Not analysed yet 7 Sept 2024
CVE-2024-39718 CVE record

CVSS 8.1 High

An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account.
- Veeam Backup and Recovery
Not analysed yet 7 Sept 2024