CVE-2022-26501: Veeam Backup & Replication Remote Code Execution Vulnerability

CVE-2022-26501 is a remote code execution vulnerability in Veeam Backup & Replication. The Veeam Distribution Service allows unauthenticated users to reach internal API functions; a remote attacker can send input that may result in uploading and executing malicious code.

Backup infrastructure is high-value because it often holds credentials, snapshots, and recovery paths for the rest of the estate. The vulnerability is known to have been used by ransomware operators, so unpatched instances should be treated as urgent. Confirm every version, configuration, and fix detail against the vendor advisory.

How it works

The underlying weakness is CWE-306, Missing Authentication for Critical Function. The Distribution Service exposes internal API functions without requiring authentication.

An attacker who can reach the service sends crafted input to those API functions. Because authentication is absent, the input can lead to file upload and subsequent code execution on the host running the service. Exact request formats, ports, and preconditions are not detailed here; they must be taken from the vendor advisory rather than assumed.

Am I affected? How to find it in your systems

Veeam Backup & Replication is typically installed on dedicated Windows servers or virtual machines that manage backups of hypervisors, servers, and endpoints. The Distribution Service is a component of that application.

• Inventory every host that runs Veeam Backup & Replication, noting whether the Distribution Service is present and listening.
• Compare installed product versions and build numbers with the affected ranges published in the vendor advisory for CVE-2022-26501; public detail on exact versions is limited, so verify directly with Veeam.
• Identify any instances reachable from untrusted networks or lacking network segmentation.
• Review service and application logs for unexpected calls to internal API endpoints, anomalous file-creation events under Veeam directories, or process launches spawned by the Distribution Service. Network telemetry showing unsolicited inbound traffic to the service is also worth investigating.

How to remediate

Apply the updates supplied by Veeam according to the vendor instructions for this CVE. CISA’s required action is simply to apply those updates.

• Schedule and deploy the vendor patch on all affected Backup & Replication servers as the primary remediation.
• After installation, confirm the Distribution Service no longer permits unauthenticated access to the internal API.
• As general hardening for this class of flaw, restrict the service to management networks only, enforce least privilege on service accounts, and keep the backup environment isolated from production user networks.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls that address the missing-authentication nature of the flaw.

• Place Veeam hosts behind strict network segmentation so the Distribution Service is reachable only from a small set of authorized management systems.
• Apply host or network firewall rules that deny inbound connections to the service from any other source.
• If a web application firewall or virtual-patching capability is available, block unauthenticated requests that target the internal API paths; validate any such rules against the vendor advisory.
• Disable the Distribution Service entirely if operational testing shows it is not required for current backup workflows.
• Increase monitoring and alerting on the service for anomalous API activity, unexpected file writes, and new process creation.

If your data may have been exposed

Actively exploited vulnerabilities of this type, including those with known ransomware use, frequently lead to broader compromise of backup data, credentials, or adjacent systems. If exploitation is suspected, isolate the affected hosts, preserve logs and forensic images, and follow your incident-response plan. Separately, you can run a free exposure scan of your email addresses to check whether they appear in known breach data sets.