CVE-2023-27532: Veeam Backup & Replication missing authentication exposes stored credentials

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, and requires no authentication or user interaction over the network.

What it is

Veeam Backup & Replication contains a missing authentication flaw in a critical function that allows encrypted credentials stored in the configuration database to be obtained. Because those credentials protect the backup infrastructure, their exposure can lead to compromise of backup hosts.

Impact

An attacker can retrieve encrypted credentials from the configuration database and use them to reach backup infrastructure hosts. This can enable further access to systems that hold or manage backups.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction required. The flaw is in the Cloud Connect component per CISA's KEV entry, and the missing authentication means no valid account is needed to reach the vulnerable function.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2023-08-22 with known ransomware campaign use, and EPSS shows a 30-day probability of 0.7761 (99.5th percentile), indicating active exploitation is expected.

What to do

• Apply the vendor fix from Veeam KB4424 immediately; if patching is not possible, follow the vendor's mitigation guidance or discontinue use of the affected component.
• Restrict network access to Veeam Cloud Connect and backup infrastructure ports to trusted management networks only.
• Rotate credentials stored in the Veeam configuration database and any credentials used by backup infrastructure hosts after patching.
• Monitor for and investigate any unexpected access to backup infrastructure hosts, treating it as potential lateral movement.

Detection

• Hunt for unusual network connections to Veeam Cloud Connect or backup server ports from hosts that do not normally manage backups.
• Review Veeam and host logs for credential access or configuration database reads outside normal backup operations.
• Correlate backup infrastructure host logons with known administrative accounts and alert on new or unexpected source hosts.
• Use the CISA KEV entry and vendor advisory to confirm affected deployments and verify patch status across all Veeam Backup & Replication instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.