# CVE-2026-58070: Veeam Backup & Replication cleartext credential logging

Source: https://junglewise.ai/threats/cve-2026-58070-veeam-backup-replication-cleartext-credential-logging  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-58070 · Severity: info · CVSS 6.8 · Published 2026-08-26

Veeam Backup & Replication, used for data protection and disaster recovery, stores guest operating system credentials in cleartext within log files on guest machines during Application-Aware processing. A local user with read access to these logs can retrieve privileged account credentials, potentially allowing unauthorized administrative access to guest systems.

Technologies: [Veeam Backup & Replication](https://junglewise.ai/threats/technologies/backup-replication). Vendors: [Veeam](https://junglewise.ai/threats/vendors/veeam).

## Quick answers

**Is CVE-2026-58070 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58070 being exploited in the wild.

**How severe is CVE-2026-58070?** Informational severity, with a CVSS score of 6.8, published 26 August 2026.

**Which products and versions are affected?** Veeam Backup & Replication 13.0.2.29 and earlier 13.x builds.

**Is there a fix for CVE-2026-58070?** A patch was published on 2026-08-25: Fix released in Veeam Backup & Replication 13.1.0.411 and 13.0.3.63 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58070 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-58070?** Check whether you run Veeam Backup & Replication at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an insecure logging issue in Veeam Backup & Replication's Application-Aware processing feature. Guest OS credentials used for this processing are written in cleartext to log files stored on the guest machine. An attacker with local access and read permissions to log files can recover these credentials, gaining privileged access to guest systems. The attack requires local file system access (not network-based) and applies to Windows-based deployments running version 13.0.2.29 and earlier 13.x builds. Fixes are available in Veeam Backup & Replication 13.1.0.411 and 13.0.3.63. Organizations should patch immediately and reset affected credentials, as existing log files are not automatically remediated.

## Affected products

- Veeam Backup & Replication 13.0.2.29 and earlier 13.x builds

## Timeline

- 2026-08-26: disclosed: Vulnerability published on NVD
- 2026-08-25: patched: Fix released in Veeam Backup & Replication 13.1.0.411 and 13.0.3.63

## References

- [https://www.veeam.com/kb4902](https://www.veeam.com/kb4902)

## Related threats

- [Veeam Backup & Replication authorization bypass in CDP Coordinator](https://junglewise.ai/threats/cve-2026-108142-a-vulnerability-allowing-an-unauthenticated-attacker-to-bypass)
- [Veeam Backup & Replication path traversal in restore](https://junglewise.ai/threats/cve-2026-108141-a-vulnerability-allowing-an-authenticated-user-with-the-restore)
- [Veeam Backup & Replication path traversal via restore operator](https://junglewise.ai/threats/cve-2026-108140-a-vulnerability-allowing-an-authenticated-user-with-the-restore)
- [Veeam Backup & Replication privilege escalation in Enterprise Manager](https://junglewise.ai/threats/cve-2026-93026-this-vulnerability-in-veeam-backup-replication-allows-a-backup)
- [Veeam Backup & Replication arbitrary file read in Cloud Connect](https://junglewise.ai/threats/cve-2026-58069-this-vulnerability-in-veeam-backup-replication-allows-an)