# Veeam vulnerabilities Source: https://junglewise.ai/threats/vendors/veeam Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/veeam.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 46 vulnerabilities in Veeam: 0 in the last 7 days and 19 in the last 90 days, 11 of them critical and 4 exploited in the wild. The most recent, CVE-2026-107239, was published on 29 October 2026. 12 vulnerabilities in the last four weeks, up 100% on the four before (6). 7 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 12 - Last 90 days: 19 - All time: 46 (11 critical, 4 exploited in the wild) ## About Veeam A software company that develops backup, disaster recovery, and data management solutions for virtual, physical, and cloud environments. ## Latest Veeam vulnerabilities - [CVE-2026-107239: Veeam Management Pack for Microsoft System Center remote code execution](https://junglewise.ai/threats/cve-2026-107239-a-vulnerability-allowing-a-member-of-the-veeam-virtualization) (info, published 29 Oct 2026) - [CVE-2026-107238: Veeam Management Pack for Microsoft System Center authenticated RCE as LocalSystem](https://junglewise.ai/threats/cve-2026-107238-a-vulnerability-allowing-an-authenticated-domain-user-to-perform) (info, published 29 Oct 2026) - [CVE-2023-22793: Veeam Management Pack remote code execution in Virtualization Extensions](https://junglewise.ai/threats/cve-2023-22793-a-vulnerability-allowing-an-unauthenticated-attacker-to-perform) (info, published 29 Oct 2026) - [CVE-2026-108142: Veeam Backup & Replication authorization bypass in CDP Coordinator](https://junglewise.ai/threats/cve-2026-108142-a-vulnerability-allowing-an-unauthenticated-attacker-to-bypass) (info, published 27 Oct 2026) - [CVE-2026-108141: Veeam Backup & Replication path traversal in restore](https://junglewise.ai/threats/cve-2026-108141-a-vulnerability-allowing-an-authenticated-user-with-the-restore) (info, published 27 Oct 2026) - [CVE-2026-108140: Veeam Backup & Replication path traversal via restore operator](https://junglewise.ai/threats/cve-2026-108140-a-vulnerability-allowing-an-authenticated-user-with-the-restore) (info, published 27 Oct 2026) - [CVE-2026-107671: Veeam ONE MFA bypass with administrator credentials](https://junglewise.ai/threats/cve-2026-107671-a-vulnerability-allowing-an-attacker-with-valid-administrator) (info, published 27 Oct 2026) - [CVE-2026-106078: Veeam Backup for Microsoft 365 REST API authentication bypass](https://junglewise.ai/threats/cve-2026-106078-a-vulnerability-allowing-an-unauthenticated-attacker-to-bypass) (info, published 27 Oct 2026) - [CVE-2026-106077: Veeam Backup for Microsoft 365 arbitrary file read in Admin role](https://junglewise.ai/threats/cve-2026-106077-a-vulnerability-allowing-a-user-with-the-veeam-backup-for) (info, published 27 Oct 2026) - [CVE-2026-106076: Veeam Backup for Microsoft 365 SQL injection in configuration database](https://junglewise.ai/threats/cve-2026-106076-a-vulnerability-allowing-an-authenticated-organization-transfer) (info, published 27 Oct 2026) - [CVE-2026-105477: Veeam Agent for Linux local privilege escalation](https://junglewise.ai/threats/cve-2026-105477-a-vulnerability-in-veeam-agent-for-linux-allows-for-local) (info, published 27 Oct 2026) - [CVE-2025-64394: Veeam Backup for Microsoft 365 privilege escalation during installation](https://junglewise.ai/threats/cve-2025-64394-a-vulnerability-allowing-a-low-privileged-local-user-to-write) (info, published 27 Oct 2026) - [CVE-2026-93026: Veeam Backup & Replication privilege escalation in Enterprise Manager](https://junglewise.ai/threats/cve-2026-93026-this-vulnerability-in-veeam-backup-replication-allows-a-backup) (info, published 7 Oct 2026) - [CVE-2026-58069: Veeam Backup & Replication arbitrary file read in Cloud Connect](https://junglewise.ai/threats/cve-2026-58069-this-vulnerability-in-veeam-backup-replication-allows-an) (info, published 7 Oct 2026) - [CVE-2026-58068: Veeam Agent for Microsoft Windows process termination privilege escalation](https://junglewise.ai/threats/cve-2026-58068-this-vulnerability-in-veeam-agent-for-microsoft-windows-allows) (info, published 7 Oct 2026) - [CVE-2025-64393: Veeam Backup & Replication insecure deserialization in Mount Service](https://junglewise.ai/threats/cve-2025-64393-this-vulnerability-in-veeam-backup-replication-allows-a-backup) (info, published 7 Oct 2026) - [CVE-2025-64392: Veeam Backup Enterprise Manager reflected cross-site scripting](https://junglewise.ai/threats/cve-2025-64392-this-vulnerability-in-veeam-backup-enterprise-manager-allows-an) (info, published 7 Oct 2026) - [CVE-2025-64391: Veeam Agent for Microsoft Windows arbitrary file write via mount point manipulation](https://junglewise.ai/threats/cve-2025-64391-this-vulnerability-in-veeam-agent-for-microsoft-windows-allows-a) (info, published 7 Oct 2026) - [CVE-2026-58070: Veeam Backup & Replication cleartext credential logging](https://junglewise.ai/threats/cve-2026-58070-veeam-backup-replication-cleartext-credential-logging) (info, CVSS 6.8, published 26 Aug 2026) - [CVE-2026-58073: Veeam Service Provider Console agent impersonation](https://junglewise.ai/threats/cve-2026-58073-veeam-service-provider-console-agent-impersonation) (info, CVSS 9.5, published 4 Aug 2026) - [CVE-2026-58072: Veeam Service Provider Console arbitrary file write and RCE](https://junglewise.ai/threats/cve-2026-58072-veeam-service-provider-console-arbitrary-file-write-and-rce) (info, CVSS 9, published 4 Aug 2026) - [CVE-2026-58071: Veeam Service Provider Console unauthenticated admin API access](https://junglewise.ai/threats/cve-2026-58071-veeam-service-provider-console-unauthenticated-admin-api-access) (info, CVSS 8.2, published 4 Aug 2026) - [CVE-2026-58067: Veeam Service Provider Console memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-58067-veeam-service-provider-console-memory-exhaustion-denial-of) (info, CVSS 8.7, published 4 Aug 2026) - [CVE-2026-64635: Veeam Service Provider Console account takeover via password reset hijacking](https://junglewise.ai/threats/cve-2026-64635-veeam-service-provider-console-account-takeover-via-password) (medium, CVSS 5.3, published 30 Jul 2026) - [CVE-2026-56844: Veeam Software Appliance path traversal in Updater component](https://junglewise.ai/threats/cve-2026-56844-veeam-software-appliance-path-traversal-in-updater-component) (info, CVSS 8.4, published 22 Jul 2026) ## Most severe Veeam vulnerabilities - [CVE-2024-40711: Veeam Backup and Replication Deserialization Vulnerability](https://junglewise.ai/threats/cve-2024-40711-veeam-backup-and-replication-deserialization-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 17 Oct 2024) - [CVE-2022-26501: Veeam Backup & Replication Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2022-26501-veeam-backup-replication-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 13 Dec 2022) - [CVE-2022-26500: Veeam Backup & Replication Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2022-26500-veeam-backup-replication-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 13 Dec 2022) - [CVE-2023-27532: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability](https://junglewise.ai/threats/cve-2023-27532-veeam-backup-replication-cloud-connect-missing-authentication-for) (critical, exploited in the wild, CVSS 7.5, published 22 Aug 2023) - [CVE-2026-21708: Veeam Backup & Replication SQL injection RCE as postgres user](https://junglewise.ai/threats/cve-2026-21708-veeam-backup-replication-sql-injection-rce-as-postgres-user) (critical, CVSS 9.9, published 12 Mar 2026) - [CVE-2025-48983: A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on…](https://junglewise.ai/threats/cve-2025-48983-a-vulnerability-in-the-mount-service-of-veeam-backup-replication) (critical, CVSS 9.9, published 31 Oct 2025) - [CVE-2026-21669: A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.](https://junglewise.ai/threats/cve-2026-21669-a-vulnerability-allowing-an-authenticated-domain-user-to-perform) (critical, CVSS 9.9, published 12 Mar 2026) - [CVE-2026-21671: A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution…](https://junglewise.ai/threats/cve-2026-21671-a-vulnerability-allowing-an-authenticated-user-with-the-backup) (critical, CVSS 9.1, published 12 Mar 2026) - [CVE-2025-59470: This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a…](https://junglewise.ai/threats/cve-2025-59470-this-vulnerability-allows-a-backup-operator-to-perform-remote) (critical, CVSS 9, published 8 Jan 2026) - [CVE-2025-59468: This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by…](https://junglewise.ai/threats/cve-2025-59468-this-vulnerability-allows-a-backup-administrator-to-perform) (critical, CVSS 9, published 8 Jan 2026) ## Vulnerabilities per week 12 vulnerabilities in the last four weeks, up 100% on the four before (6). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 6 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 12 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Veeam technologies - [Veeam Backup & Replication](https://junglewise.ai/threats/technologies/backup-replication): 17 vulnerabilities - [Veeam Backup \](https://junglewise.ai/threats/technologies/veeam-backup): 11 vulnerabilities - [Veeam Service Provider Console](https://junglewise.ai/threats/technologies/service-provider-console): 6 vulnerabilities - [Veeam Replication](https://junglewise.ai/threats/technologies/veeam-replication): 6 vulnerabilities - [Veeam Backup for Microsoft 365](https://junglewise.ai/threats/technologies/backup-for-microsoft-365): 4 vulnerabilities - [Veeam Agent for Microsoft Windows](https://junglewise.ai/threats/technologies/agent-for-microsoft-windows): 3 vulnerabilities - [Veeam Management Pack for Microsoft System Center](https://junglewise.ai/threats/technologies/management-pack-for-microsoft-system-center): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Veeam vulnerabilities", https://junglewise.ai/threats/vendors/veeam, 9 November 2026.