CVE-2022-26500

Summary

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://veeam.com
• https://www.veeam.com/kb4288

CISA ADP Vulnrichment

• SSVC:
• Exploitation: active
  • Automatable: no
  • Technical Impact: total

Additional References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26500

References

• https://veeam.com
• https://www.veeam.com/kb4288

• ←Previous
• Next→