This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.

Backup and Replication · Missing authorization · CWE-862

AffectedBackup and Replication

FixUpdate to 12.3.2.4934 or newer

PublishedOct 7, 08:49 · hackerone

ScoredOct 7 · 6.1 · hackerone

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:10 UTC

What we know

No known exploitation. CISA KEV, checked 22:10 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker needs network access and an account. CVSS: network, low privileges.

It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.

A successful attack can change data. CVSS impact.

Description

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.

From hackerone

Affected and fixed versions

ProductAffectedFixed inBackup and Replication12 – before 12.3.2.493412.3.2.4934

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

www.veeam.com/KB4934 · veeam.com

Other CVEs in Backup and Replication

All 20 →

5.9A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write… · CVE-2026-108141Oct 27 9.1A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. · CVE-2026-108142Oct 27 5.9A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write… · CVE-2026-108140Oct 27