Veeam Backup & Replication Remote Code Execution Vulnerability (CVE-2022-26500)

What is affected, what to do

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Conflicting version data — version display is hidden until the data is resolved.

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory and exposure check: Locate every Veeam Backup & Replication server and record its build (Console → Help → About). Affected are 9.5U3 (9.5.0.1536), 9.5U4 (9.5.4.2615), 10.x and 11.x. Run netstat -ano | findstr :9380 to confirm whether the Veeam Distribution Service listens on TCP 9380 and from which networks it is reachable.
   • Patch: Upgrade v10 to build 10.0.1.4854 and v11 to build 11.0.1.1261, including the cumulative security hotfix referenced in the vendor advisory. Check the Veeam advisory for CVE-2022-26500 for the exact patch level; the same fix covers the sibling flaw CVE-2022-26501. 9.5U3/U4 receives no fix. Migrate those servers to a supported major version, and keep them fully isolated until then.
   • Restrict port 9380 now: Until patched, use the host firewall or segment firewall to allow inbound TCP 9380 only from your own Veeam components (proxies, repositories, console). Drop it from client and internet-facing networks.
   • Compromise assessment before patching: Run a quick hunt on the backup server (see Detection rules). Patching does not remove persistence an attacker has already planted.
   • Rotate credentials if suspicious: Reset every account stored in the Veeam Credentials Manager (domain, hypervisor, repository, cloud) plus local admin accounts on the backup server. The backup server usually holds high-privilege credentials for the whole estate.
   • Protect recoverability: Confirm immutable or offline copies exist (Hardened Repository, Object Lock, tape). If not, create an air-gapped copy of critical backups immediately.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place the backup server in a dedicated management/backup VLAN. Allow inbound only from admin jump hosts and Veeam infrastructure, per the Veeam port matrix, with TCP 9380 explicitly on an allowlist. Block outbound internet except update destinations.
   • IPS/network rule: Deploy a Suricata/Snort rule that alerts on or drops any connection to $BACKUP_SERVERS on TCP 9380 from outside $VEEAM_INFRA. Enable any vendor IPS signatures for CVE-2022-26500/26501.
   • IAM / least privilege: Remove the backup server from the production domain (workgroup or separate management domain). Run Veeam services and stored credentials with least privilege and no Domain Admin accounts. Enforce MFA on console logon.
   • Endpoint hardening: Run the EDR in block mode. Use ASR rules or AppLocker/WDAC to prevent unsigned binaries and DLLs from executing out of Veeam install and temp paths. Enable PowerShell Script Block Logging.
   • Configuration change: If the Distribution Service is not required on this server (no remote component deployment), assess the operational impact, then stop or disable it until patched.
3. 03

   Runbook step 3

   Detection rules

   • Network telemetry (Zeek/Suricata/firewall): Flag TCP 9380 connections from sources outside the Veeam infrastructure, especially clients, VPN pools or external IPs. Zeek example: conn.log id.resp_p==9380 && !(id.orig_h in veeam_infra).
   • Process ancestry (Sysmon EID 1 / EDR): Flag Veeam service processes (Veeam.*.exe) spawning shells or LOLBins. Sigma shape: ParentImage|contains: '\Veeam' AND Image|endswith: ['\cmd.exe','\powershell.exe','\rundll32.exe','\mshta.exe','\certutil.exe'].
   • File creation (Sysmon EID 11 / EDR): Flag new .dll/.exe files written by a Veeam process into Veeam install directories or C:\Windows\Temp outside a planned update window.
   • Windows Security log: Watch for 4720/4732 (new account or local admin group change) and 7045 (new service) on the backup server, plus 4624 logon types 3/10 from unusual sources. KQL: DeviceProcessEvents | where InitiatingProcessFileName startswith "Veeam" and FileName in~ ("cmd.exe","powershell.exe").
   • Ransomware staging: Watch for deleted backup jobs or restore points in the Veeam Backup application event log, vssadmin delete shadows, wbadmin delete, and bulk access to repository shares.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.

Source: cvelistv5, NVD (NIST), CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Veeam Veeam Backup \& Replication

References & sources

• veeam.comx_refsource_MISC, Vendor advisory
• veeam.comkb4288x_refsource_MISC, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26500government-resource, US government resource