CVE-2022-26504 : Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x

Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe

Published 2022-03-17 21:15:08

Updated 2024-05-09 18:37:55

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute codeBypassGain privilege

Products affected by CVE-2022-26504

Veeam » Veeam Backup & Replication
Versions from including (>=) 10.0.0.4442 and before (<) 10.0.1.4854
cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*
Matching versions
Veeam » Veeam Backup & Replication
Versions from including (>=) 11.0.0.825 and before (<) 11.0.1.1261
cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*
Matching versions
Veeam » Veeam Backup & Replication » Version: 9.5.0.1536
cpe:2.3:a:veeam:veeam_backup_\&_replication:9.5.0.1536:*:*:*:*:*:*:*
Matching versions
Veeam » Veeam Backup & Replication » Version: 9.5.4.2615
cpe:2.3:a:veeam:veeam_backup_\&_replication:9.5.4.2615:*:*:*:*:*:*:*
Matching versions
Veeam » Veeam Backup & Replication » Version: 10.0.1.4854
cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:-:*:*:*:*:*:*
Matching versions
Veeam » Veeam Backup & Replication » Version: 10.0.1.4854 Update P20201202
cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20201202:*:*:*:*:*:*
Matching versions
Veeam » Veeam Backup & Replication » Version: 10.0.1.4854 Update P20210609
cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20210609:*:*:*:*:*:*
Matching versions
Veeam » Veeam Backup & Replication » Version: 11.0.1.1261
cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:-:*:*:*:*:*:*
Matching versions
Veeam » Veeam Backup & Replication » Version: 11.0.1.1261 Update P20211123
cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211123:*:*:*:*:*:*
Matching versions
Veeam » Veeam Backup & Replication » Version: 11.0.1.1261 Update P20211211
cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211211:*:*:*:*:*:*
Matching versions
Veeam » Veeam Backup & Replication » Version: 10.0.1.4854 Update P20220304
cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20220304:*:*:*:*:*:*
Matching versions
Veeam » Veeam Backup & Replication » Version: 11.0.1.1261 Update P20220302
cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20220302:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-26504

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 44 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-26504

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C	8.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-26504

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-26504

https://www.veeam.com/kb4290

KB4290: CVE-2022-26504
Vendor Advisory
https://veeam.com

Veeam Software - Accelerate Your Data Protection Strategy
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-26504

Products affected by CVE-2022-26504

Exploit prediction scoring system (EPSS) score for CVE-2022-26504

CVSS scores for CVE-2022-26504

CWE ids for CVE-2022-26504

References for CVE-2022-26504