Veeam: nine vulnerabilities with RCE and privilege escalation

On 28 October 2026 CERT-FR, the incident response centre of the French agency ANSSI, published advisory CERTFR-2026-AVI-1399 on multiple vulnerabilities in Veeam products. According to CERT-FR, some of them allow an attacker to achieve remote arbitrary code execution, privilege escalation and a breach of data confidentiality.

The advisory is based on three security bulletins published by Veeam on 27 October 2026: kb4948, kb4951 and kb4957. For now the CERT-FR advisory is the only source: below we report what it says and point out what it does not say, without adding assumptions.

What the advisory says

• Reference: CERTFR-2026-AVI-1399, first version dated 28 October 2026.
• Sources of the advisory: Veeam bulletins kb4948, kb4951 and kb4957 of 27 October 2026.
• Risks listed by CERT-FR:
  • remote arbitrary code execution;
  • privilege escalation;
  • SQL injection (SQLi);
  • breach of data confidentiality;
  • breach of data integrity;
  • security policy bypass;
  • denial of service (DoS).
• Solution: apply the fixes listed in the vendor’s bulletins.

Affected versions

According to CERT-FR, the following are vulnerable:

• Veeam Agent for Linux: versions prior to 13.1.2 (build 13.1.2.11);
• Veeam Backup & Replication 13.0.x: versions prior to 13.0.3 (build 13.0.3.63);
• Veeam Backup & Replication 13.1.x: versions prior to 13.1.2 (build 13.1.2.57);
• Veeam Backup for Microsoft 365: versions prior to 8.6 Patch 1 (build 8.6.0.5011);
• Veeam ONE: versions prior to 13.1 P1 (build 13.1.0.7940).

For Veeam Backup & Replication the advisory only lists the 13.0 and 13.1 branches. If you run a different branch, check Veeam’s bulletins to see whether and how it is affected.

The CVEs

The advisory cites nine identifiers:

• CVE-2025-64394
• CVE-2026-105477
• CVE-2026-106076
• CVE-2026-106077
• CVE-2026-106078
• CVE-2026-107671
• CVE-2026-108140
• CVE-2026-108141
• CVE-2026-108142

What the advisory does not say

The CERT-FR advisory is brief. In particular, it does not include:

• which CVE affects which product, or which Veeam bulletin covers which product;
• CVSS scores and the severity of each vulnerability;
• the exploitation conditions: whether authentication is required, which privileges are needed, which component or service is involved;
• any exploitation in the wild or public exploit code;
• indicators of compromise or MITRE ATT&CK techniques.

For all these details, Veeam’s bulletins kb4948, kb4951 and kb4957 are the authoritative reference. The advisory is in its initial version and may be updated.

What these products are

Veeam Backup & Replication is the server that manages backups and replicas of virtual machines, physical servers and other workloads. Veeam Agent for Linux runs backups on individual Linux machines. Veeam Backup for Microsoft 365 backs up data from Microsoft 365 services such as mail, OneDrive, SharePoint and Teams. Veeam ONE monitors the backup infrastructure and produces reports.

To do their job, these components usually have broad access to the systems they protect and store the credentials needed to reach them.

Impact for European and Italian organisations

Backup is the last line of defence for recovering after an incident, ransomware included. A vulnerability that allows code execution or higher privileges on a component of the backup infrastructure can put at risk both the stored data and the ability to restore it. How serious the risk is for each product, however, can only be assessed with the details in the bulletins, which the advisory does not include.

For entities in scope of NIS2 (in Italy, Legislative Decree 138/2024), backup and recovery management is part of the business continuity measures, and vulnerability handling must be documented, with explicit priorities and timelines. In healthcare, where restoring clinical systems depends on backups, updates to the backup infrastructure deserve the same attention. Any significant incident must be assessed for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN.

What to do now

1. Take inventory: list your Veeam Backup & Replication servers, the Linux machines running Veeam Agent for Linux, your Veeam Backup for Microsoft 365 installations and your Veeam ONE servers, with the installed version and build.
2. Read Veeam’s bulletins kb4948, kb4951 and kb4957 to find out which CVEs affect your products, how severe they are and under what conditions.
3. Update at least to the versions indicated by CERT-FR: Agent for Linux 13.1.2 (13.1.2.11), Backup & Replication 13.0.3 (13.0.3.63) or 13.1.2 (13.1.2.57), Backup for Microsoft 365 8.6 Patch 1 (8.6.0.5011), Veeam ONE 13.1 P1 (13.1.0.7940).
4. Check after updating that the installed build matches the expected one on every component, including the Linux machines running the agent.
5. Restrict access: as a general rule, backup consoles and management services should only be reachable from administrative networks and workstations, never from the Internet.
6. Monitor: as good practice, investigate unusual console logins, new accounts, changes to backup jobs or retention settings, and deletion of restore points.
7. Follow updates to the CERT-FR advisory and Veeam’s bulletins for any news on exploitation or indicators.

How ARXDOME helps

ARX Shield lists open vulnerabilities by machine and by package on monitored machines, highlighting those already exploited: it helps you find the Veeam components that still need updating. ARX Expose shows which services your company exposes to the Internet and which products are recognised on them, useful for checking that backup management consoles cannot be reached from outside. With ARX Sentry, server logs and events flow into the portal, so unusual access stays in front of the analysts.

Last updated: 28 October 2026