Veeam Backup & Replication Remote Code Execution Vulnerability (CVE-2022-26501)
Severity: critical · Patch status: patched · Since 2022-12-13 · CVE-2022-26501
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code. CISA added CVE-2022-26501 to its Known Exploited Vulnerabilities catalog on Dec 13, 2022, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.
What to do
- Apply updates per vendor instructions.
- US federal agencies must remediate by Jan 3, 2023 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
