VEEAM Backup And Recovery

• CVE-2024-40711 Critical 9.8 Exploited A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). 90.4%
• CVE-2025-59468 Critical 9.0 This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter. 1.2%
• CVE-2025-55125 High 7.8 This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file. 1.0%
• CVE-2025-59469 Critical 9.0 This vulnerability allows a Backup or Tape Operator to write files as root. 0.7%
• CVE-2025-59470 Critical 9.0 This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter. 1.5%
• CVE-2025-24286 High 7.2 A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code. 19.1%
• CVE-2025-23121 Critical 9.9 A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user 24.7%
• CVE-2025-23120 Critical 9.9 A vulnerability allowing remote code execution (RCE) for domain users. 24.0%
• CVE-2024-40714 High 8.3 An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations. 0.4%
• CVE-2024-40713 High 7.8 A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA. 0.3%
• CVE-2024-40709 High 7.8 A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level. 0.2%
• CVE-2024-40712 High 7.8 A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE). 0.3%
• CVE-2024-40710 High 8.8 A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and passwords) 1.1%
• CVE-2024-39718 High 8.1 An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. 0.8%