# Veeam Backup & Replication vulnerabilities Source: https://junglewise.ai/threats/technologies/backup-replication Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/backup-replication.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in Veeam Backup & Replication: 0 in the last 7 days and 8 in the last 90 days, 5 of them critical and 4 exploited in the wild. The most recent, CVE-2026-108142, was published on 27 October 2026. 3 vulnerabilities in the last four weeks, down 25% on the four before (4). ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 8 - All time: 17 (5 critical, 4 exploited in the wild) ## About Veeam Backup & Replication Backup and disaster recovery software for virtualizing and protecting enterprise IT environments. ## Latest Veeam Backup & Replication vulnerabilities - [CVE-2026-108142: Veeam Backup & Replication authorization bypass in CDP Coordinator](https://junglewise.ai/threats/cve-2026-108142-a-vulnerability-allowing-an-unauthenticated-attacker-to-bypass) (info, published 27 Oct 2026) - [CVE-2026-108141: Veeam Backup & Replication path traversal in restore](https://junglewise.ai/threats/cve-2026-108141-a-vulnerability-allowing-an-authenticated-user-with-the-restore) (info, published 27 Oct 2026) - [CVE-2026-108140: Veeam Backup & Replication path traversal via restore operator](https://junglewise.ai/threats/cve-2026-108140-a-vulnerability-allowing-an-authenticated-user-with-the-restore) (info, published 27 Oct 2026) - [CVE-2026-93026: Veeam Backup & Replication privilege escalation in Enterprise Manager](https://junglewise.ai/threats/cve-2026-93026-this-vulnerability-in-veeam-backup-replication-allows-a-backup) (info, published 7 Oct 2026) - [CVE-2026-58069: Veeam Backup & Replication arbitrary file read in Cloud Connect](https://junglewise.ai/threats/cve-2026-58069-this-vulnerability-in-veeam-backup-replication-allows-an) (info, published 7 Oct 2026) - [CVE-2025-64393: Veeam Backup & Replication insecure deserialization in Mount Service](https://junglewise.ai/threats/cve-2025-64393-this-vulnerability-in-veeam-backup-replication-allows-a-backup) (info, published 7 Oct 2026) - [CVE-2025-64392: Veeam Backup Enterprise Manager reflected cross-site scripting](https://junglewise.ai/threats/cve-2025-64392-this-vulnerability-in-veeam-backup-enterprise-manager-allows-an) (info, published 7 Oct 2026) - [CVE-2026-58070: Veeam Backup & Replication cleartext credential logging](https://junglewise.ai/threats/cve-2026-58070-veeam-backup-replication-cleartext-credential-logging) (info, CVSS 6.8, published 26 Aug 2026) - [CVE-2026-56844: Veeam Software Appliance path traversal in Updater component](https://junglewise.ai/threats/cve-2026-56844-veeam-software-appliance-path-traversal-in-updater-component) (info, CVSS 8.4, published 22 Jul 2026) - [CVE-2026-44963: Veeam Backup & Replication RCE via untrusted deserialization](https://junglewise.ai/threats/cve-2026-44963-veeam-backup-replication-rce-via-untrusted-deserialization) (info, CVSS 9.4, published 9 Jun 2026) - [CVE-2026-32997: Veeam Backup & Replication arbitrary file write in Software Appliance](https://junglewise.ai/threats/cve-2026-32997-veeam-backup-replication-arbitrary-file-write-in-software) (info, CVSS 8.6, published 28 May 2026) - [CVE-2026-21708: Veeam Backup & Replication SQL injection RCE as postgres user](https://junglewise.ai/threats/cve-2026-21708-veeam-backup-replication-sql-injection-rce-as-postgres-user) (critical, CVSS 9.9, published 12 Mar 2026) - [CVE-2026-21672: A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.](https://junglewise.ai/threats/cve-2026-21672-a-vulnerability-allowing-local-privilege-escalation-on-windows) (high, CVSS 8.8, published 12 Mar 2026) - [CVE-2024-40711: Veeam Backup and Replication Deserialization Vulnerability](https://junglewise.ai/threats/cve-2024-40711-veeam-backup-and-replication-deserialization-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 17 Oct 2024) - [CVE-2023-27532: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability](https://junglewise.ai/threats/cve-2023-27532-veeam-backup-replication-cloud-connect-missing-authentication-for) (critical, exploited in the wild, CVSS 7.5, published 22 Aug 2023) - [CVE-2022-26501: Veeam Backup & Replication Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2022-26501-veeam-backup-replication-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 13 Dec 2022) - [CVE-2022-26500: Veeam Backup & Replication Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2022-26500-veeam-backup-replication-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 13 Dec 2022) ## Most severe Veeam Backup & Replication vulnerabilities - [CVE-2024-40711: Veeam Backup and Replication Deserialization Vulnerability](https://junglewise.ai/threats/cve-2024-40711-veeam-backup-and-replication-deserialization-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 17 Oct 2024) - [CVE-2022-26501: Veeam Backup & Replication Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2022-26501-veeam-backup-replication-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 13 Dec 2022) - [CVE-2022-26500: Veeam Backup & Replication Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2022-26500-veeam-backup-replication-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 13 Dec 2022) - [CVE-2023-27532: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability](https://junglewise.ai/threats/cve-2023-27532-veeam-backup-replication-cloud-connect-missing-authentication-for) (critical, exploited in the wild, CVSS 7.5, published 22 Aug 2023) - [CVE-2026-21708: Veeam Backup & Replication SQL injection RCE as postgres user](https://junglewise.ai/threats/cve-2026-21708-veeam-backup-replication-sql-injection-rce-as-postgres-user) (critical, CVSS 9.9, published 12 Mar 2026) - [CVE-2026-21672: A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.](https://junglewise.ai/threats/cve-2026-21672-a-vulnerability-allowing-local-privilege-escalation-on-windows) (high, CVSS 8.8, published 12 Mar 2026) - [CVE-2026-44963: Veeam Backup & Replication RCE via untrusted deserialization](https://junglewise.ai/threats/cve-2026-44963-veeam-backup-replication-rce-via-untrusted-deserialization) (info, CVSS 9.4, published 9 Jun 2026) - [CVE-2026-32997: Veeam Backup & Replication arbitrary file write in Software Appliance](https://junglewise.ai/threats/cve-2026-32997-veeam-backup-replication-arbitrary-file-write-in-software) (info, CVSS 8.6, published 28 May 2026) - [CVE-2026-56844: Veeam Software Appliance path traversal in Updater component](https://junglewise.ai/threats/cve-2026-56844-veeam-software-appliance-path-traversal-in-updater-component) (info, CVSS 8.4, published 22 Jul 2026) - [CVE-2026-58070: Veeam Backup & Replication cleartext credential logging](https://junglewise.ai/threats/cve-2026-58070-veeam-backup-replication-cleartext-credential-logging) (info, CVSS 6.8, published 26 Aug 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, down 25% on the four before (4). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 4 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Veeam technologies - [Veeam Backup \](https://junglewise.ai/threats/technologies/veeam-backup): 11 vulnerabilities - [Veeam Service Provider Console](https://junglewise.ai/threats/technologies/service-provider-console): 6 vulnerabilities - [Veeam Replication](https://junglewise.ai/threats/technologies/veeam-replication): 6 vulnerabilities - [Veeam Backup for Microsoft 365](https://junglewise.ai/threats/technologies/backup-for-microsoft-365): 4 vulnerabilities - [Veeam Agent for Microsoft Windows](https://junglewise.ai/threats/technologies/agent-for-microsoft-windows): 3 vulnerabilities - [Veeam Management Pack for Microsoft System Center](https://junglewise.ai/threats/technologies/management-pack-for-microsoft-system-center): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Veeam Backup & Replication vulnerabilities", https://junglewise.ai/threats/technologies/backup-replication, 9 November 2026.