CVE-2022-26500: Veeam Backup & Replication Remote Code Execution Vulnerability

CVE-2022-26500 is a remote code execution vulnerability in Veeam Backup & Replication. It stems from the Veeam Distribution Service allowing unauthenticated users to reach internal API functions; a remote attacker can supply input that may result in uploading and executing malicious code. This matters because backup infrastructure often holds privileged access to production systems and sensitive data, and the vulnerability is known to have been used in ransomware activity.

Defenders should treat any internet-reachable or poorly segmented Veeam Backup & Replication deployment as high priority until the vendor update is confirmed applied. Specifics of affected builds and exact attack paths must be verified against the vendor advisory.

How it works

The weakness is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In this case the Veeam Distribution Service exposes internal API functions without authentication. An unauthenticated remote attacker can send crafted input to those functions. Because the service does not properly constrain the input, the attacker may be able to cause the upload of attacker-controlled content and subsequent execution of that content on the host.

No further exploit mechanics are described in the public summary; treat any claim of specific payloads or sequences as unverified until confirmed in the vendor advisory or a trusted analysis. The practical outcome is remote code execution under the privileges of the Veeam service, which is typically high.

Am I affected? How to find it in your systems

Veeam Backup & Replication is commonly installed on dedicated backup servers, management hosts, or virtual appliances that communicate with production hypervisors, storage, and agents. Inventory every host that runs the Veeam Backup & Replication application or the Distribution Service component.

• Query software inventory, package managers, or configuration-management databases for “Veeam Backup & Replication” or related service names.
• Check listening ports and process lists for the Distribution Service; note any instances exposed beyond the management network.
• Confirm the exact build against the vendor advisory; public detail on version ranges is limited here, so do not rely on assumptions.
• Review authentication and network logs for unauthenticated requests targeting the Distribution Service API endpoints, unexpected file writes under Veeam directories, or process creation that coincides with those requests. Absence of such logs does not prove safety if the service was reachable.

How to remediate

Apply the updates supplied by Veeam for Backup & Replication exactly as described in the vendor advisory. CISA’s required action is to apply updates per vendor instructions; that remains the primary fix.

• After patching, restart the affected services and verify the new build number.
• Re-validate that the Distribution Service no longer accepts unauthenticated API calls that can lead to code upload or execution.
• As hardening for this class of flaw, restrict the service to authenticated management networks only, enforce least-privilege service accounts, and ensure any temporary or upload directories are not writable by unauthenticated callers.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls:

• Segment the backup infrastructure so the Distribution Service is reachable only from trusted management hosts; block inbound access from user and internet networks at the firewall.
• If a web application firewall or reverse proxy sits in front of the service, apply virtual-patching rules that reject unauthenticated or anomalous requests to the internal API endpoints (confirm signatures against the advisory).
• Disable or stop the Distribution Service if it is not required for current operations, after validating operational impact.
• Increase monitoring for the indicators listed above and alert on any process creation or file writes originating from the Veeam service account outside expected backup windows.

If your data may have been exposed

Actively exploited vulnerabilities of this type have been leveraged in ransomware campaigns, which can lead to encryption, data theft, or both. If the affected Veeam host was reachable and unpatched during the period of known exploitation, treat it as a potential compromise: isolate the host, preserve forensic images, rotate credentials that the backup service could access, and examine backup repositories for unauthorized changes. Separately, you can run a free exposure scan of your email addresses against known breach data sets to determine whether any associated accounts already appear in public breach corpora.