CVE-2023-27532: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

CVE-2023-27532 is a missing-authentication flaw in the Cloud Connect component of Veeam Backup & Replication. An unauthenticated user who can reach the backup infrastructure network perimeter can obtain encrypted credentials stored in the configuration database, which may allow further access to backup infrastructure hosts. The vulnerability has been used by ransomware operators, so organizations running this product should treat it as a priority for inventory, patching, and monitoring.

Public detail is limited to the CISA description and the CWE classification; exact product versions, CVSS scores, and exploit mechanics must be confirmed against the vendor advisory. The required action is to apply mitigations per vendor instructions or discontinue use if mitigations are unavailable.

How it works

The weakness is CWE-306: missing authentication for a critical function. In the Cloud Connect component, a critical operation that should require authentication does not properly enforce it. An attacker who is already operating inside the backup infrastructure network perimeter can invoke that function without credentials and retrieve encrypted credentials from the configuration database.

Those credentials can then be used to expand access to backup infrastructure hosts. No further exploit mechanics, payloads, or version-specific behavior are provided in the available facts; defenders should treat any unauthenticated access path to Cloud Connect management or configuration interfaces as in scope and validate details against the vendor advisory.

Am I affected? How to find it in your systems

Veeam Backup & Replication with the Cloud Connect component is typically deployed on dedicated backup servers or appliances that manage remote or multi-tenant backup traffic. Inventory every host running Veeam Backup & Replication and determine whether Cloud Connect is enabled or installed.

• Query configuration management, asset inventories, and software deployment tools for Veeam Backup & Replication installations.
• On each instance, check product documentation or the management console for Cloud Connect status and any related services or listeners that face the backup infrastructure network.
• Confirm the exact build or release against the vendor advisory; do not assume a version is safe without that check.
• Review network diagrams and firewall rules for any path that allows unauthenticated hosts inside the backup perimeter to reach Cloud Connect endpoints.

Telemetry signs of exploitation may include unexpected queries or connections to Cloud Connect services from non-management hosts, anomalous access to the configuration database, or subsequent authentication attempts using previously stored credentials. Correlate backup-server logs, authentication logs, and network flow data for such activity. Specific log signatures are not provided in the facts and must be derived from vendor guidance.

How to remediate

Apply the vendor update or mitigation named in the official advisory for CVE-2023-27532 as the primary remediation. Follow the CISA required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

• Schedule and deploy the fix on all affected Veeam Backup & Replication instances that use Cloud Connect, starting with internet-facing or multi-tenant deployments.
• After patching, verify that the critical function now requires authentication and that encrypted credentials are no longer obtainable by unauthenticated callers.
• Rotate any credentials that were stored in the configuration database and that could have been exposed, then update dependent backup jobs and host configurations.
• Harden the backup infrastructure by enforcing least-privilege access, network segmentation of management interfaces, and regular review of Cloud Connect configuration.

Document the change window and retain evidence of the applied update for audit and incident-response purposes.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls that limit reachability and detect abuse of the missing-authentication path.

• Segment the backup infrastructure so that only authorized management hosts can reach Cloud Connect listeners; block or tightly restrict all other traffic from the broader backup perimeter.
• If the product allows it, disable or decommission the Cloud Connect component on systems that do not require it.
• Apply virtual patching or WAF rules that reject unauthenticated requests to the affected function, once the exact request characteristics are confirmed from the vendor advisory.
• Increase monitoring of authentication events, configuration-database access, and lateral movement from backup servers; alert on any unauthenticated access attempts or credential use that originates from unexpected sources.
• If risk remains unacceptable, discontinue use of the product as directed by CISA until a supported mitigation is in place.

If your data may have been exposed

Actively exploited vulnerabilities of this class have been used by ransomware operators and can lead to full compromise of backup infrastructure and the data it protects. If you have evidence of unauthenticated access or credential theft, treat the incident as a potential breach: isolate affected hosts, preserve logs, rotate credentials, and engage incident response. You can also run a free exposure scan of your email addresses against known breach data to check whether related accounts appear in public dumps.