Veeam vendor intelligence
Veeam Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting Veeam products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.
- Total KEVs
- 5
- Known exploited vulnerabilities affecting Veeam products
- In CISA KEV
- 4
- Records also listed in the official catalog
- Beyond CISA KEV
- 1
- Additional exploited vulnerability absent from CISA KEV
- Sensor Observed
- 0
- Veeam KEVs with sensor-observed exploitation activity
The catalog gap matters for Veeam exposure
One of the five exploited Veeam vulnerabilities tracked by Previdian is not in CISA KEV. Teams relying on the official catalog alone would miss one-fifth of this vendor portfolio.
- 80%
- Covered by CISA
- 20%
- Beyond CISA
- 4
- Product families
Attested Veeam vulnerabilities
5 known exploited vulnerabilities in this exploited-vulnerability portfolio. Search, then narrow it to official CISA coverage or the additional records Previdian tracks beyond the catalog.
How exploitation is verified| CVE / description | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2026-32996
This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. |
Backup and Replication | High | Beyond CISA | 21 Sep 2026 |
|
CVE-2022-26501
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). |
Backup & Replication | Confirmed | In CISA | 13 Dec 2022 |
|
CVE-2022-26500
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to... |
Backup & Replication | Confirmed | In CISA | 13 Dec 2022 |
|
CVE-2023-27532
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This... |
Veeam Backup & Replication | Confirmed | In CISA | 22 Aug 2023 |
|
CVE-2024-40711
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). |
Backup and Recovery | Confirmed | In CISA | 17 Oct 2024 |
No Veeam vulnerabilities match this search or filter.
Showing 5 of 5 on this page (5 Veeam known exploited vulnerabilities).
Recurring weakness patterns
Missing authentication for critical function, limitation, and deserialization account for four mapped occurrences across this Veeam KEV portfolio.