CVE-2022-26501 Veeam Backup & Replication Remote Code Execution

Exploited in the wild Critical 9.8 Published 17 Mar 2022 Updated 21 Oct 2025

Attackers can bypass authentication controls in Veeam Backup & Replication to access protected resources without credentials.

Exploited in the wild: Since 13 Dec 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-26501?

CVE-2022-26501 is a critical missing authorization vulnerability in n/a, published on 17 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

Weakness: CWE-306

Which versions are affected by CVE-2022-26501?

It affects 1 product.

Products include Veeam Veeam Backup \& Replication.

How do I fix CVE-2022-26501?

No fix has been published for CVE-2022-26501 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 Jan 2023.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-26501 being exploited?

Yes. Attackers have exploited CVE-2022-26501 in the wild since at least 13 Dec 2022, including in ransomware campaigns.

Sources

Also known as GHSA-vhpf-rh57-x3v9.