CVE-2022-26500 Veeam Backup & Replication Remote Code Execution

Exploited in the wild High 8.8 Published 17 Mar 2022 Updated 21 Oct 2025

Remote authenticated attackers can exploit path traversal to access internal APIs and execute arbitrary code on Veeam Backup & Replication servers.

Exploited in the wild: Since 13 Dec 2022
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-26500?

CVE-2022-26500 is a high-severity path traversal vulnerability in n/a, published on 17 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.

Weakness: CWE-22

Which versions are affected by CVE-2022-26500?

It affects 1 product.

Products include Veeam Veeam Backup \& Replication.

How do I fix CVE-2022-26500?

No fix has been published for CVE-2022-26500 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 Jan 2023.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-26500 being exploited?

Yes. Attackers have exploited CVE-2022-26500 in the wild since at least 13 Dec 2022, including in ransomware campaigns.

Sources

Also known as GHSA-2vw2-587w-g9v6.