CVE-2022-26501: Veeam Backup & Replication missing authentication allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable flaw with full impact on a backup platform, confirmed exploited in the wild and linked to ransomware campaigns.

What it is

Veeam Backup & Replication 10.x and 11.x contains an incorrect access control flaw (CWE-306, missing authentication for a critical function). A remote, unauthenticated attacker can reach the affected function without credentials, and the vendor classifies the issue as one of two related access control problems. Because the product is a backup platform, compromise threatens both the backup data and the systems it protects.

Impact

An attacker gains full compromise of the affected service with high confidentiality, integrity and availability impact, potentially leading to remote code execution and destruction or theft of backup data.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The description does not name the specific exposed interface or port.

Exploitation

Listed in CISA KEV with known ransomware campaign use, so exploitation in the wild is confirmed. EPSS 30-day probability is about 4.1 percent (90th percentile), and all references are vendor advisories or the KEV entry, with no public exploit details in this record.

What to do

• Apply the vendor updates referenced in Veeam KB4288 immediately; this is the only complete fix.
• If patching cannot be done at once, isolate backup servers from untrusted networks and restrict access to management interfaces.
• Enforce network segmentation so backup infrastructure is not reachable from general user or internet-facing segments.
• Verify backups are immutable or offline so a compromised backup server cannot destroy recovery copies.
• Audit accounts and services on backup servers for unauthorized changes after any suspected exposure.

Detection

• Monitor backup server logs for unexpected or unauthenticated access to management and service interfaces.
• Alert on new or unusual processes, service creation, or outbound connections originating from backup servers.
• Watch for mass deletion, encryption or modification of backup files and repository contents.
• Correlate backup server activity with known ransomware precursor behavior such as credential dumping or lateral movement.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.