Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-26504
CVE-2022-26504:
Veeam Backup & Replication vulnerability analysis and mitigation
Overview
Improper authentication vulnerability (CVE-2022-26504) affects Veeam Backup & Replication versions 9.5U3, 9.5U4, 10.x, and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) integration. The vulnerability was discovered and disclosed in March 2022, with a CVSS v3 score of 8.8 (High severity) (Veeam KB, CloudSEK Report).
Technical details
The vulnerable process Veeam.Backup.PSManager.exe (TCP 8732 by default) allows authentication using non-administrative domain credentials. The vulnerability only affects Veeam Backup & Replication installations with an SCVMM server registered, while default installations are not vulnerable (Veeam KB).
Impact
A successful exploitation of this vulnerability allows attackers to execute arbitrary code remotely, which can lead to gaining control over the target system. The vulnerability affects Veeam Backup & Replication, which is used by 70% of Fortune 2000 companies, including major firms such as Volkswagen, Siemens, Deloitte, Shell, Fujitsu, Airbus, and Puma (SecurityWeek).
Mitigation and workarounds
Patches were released for Veeam Backup & Replication versions 11a (build 11.0.1.1261 P20220302) and 10a (build 10.0.1.4854 P20220304). The patch must be installed on the Veeam Backup & Replication server. All new deployments of versions 11 and 10 installed using ISO images dated 20220302 or later are not vulnerable (Veeam KB).
Community reactions
The vulnerability gained significant attention when CloudSEK reported multiple threat actors advertising a fully weaponized tool for remote code execution. Additionally, researchers discovered a GitHub repository containing scripts for recovering passwords from the Veeam Backup and Replication credential manager (CloudSEK Report).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management