CVEvulnerability

CVE-2023-27532

7.5 HIGH Known exploited Published 2023-03-10 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability — Veeam Backup & Replication

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.

Added to KEV: 2023-08-22
Remediation due: 2023-09-12
Ransomware use: Known
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://www.veeam.com/kb4424; https://nvd.nist.gov/vuln/detail/CVE-2023-27532

Status: Analyzed
Published: 2023-03-10
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-306

Description

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.

Affected configurations

• veeam veeam backup \& replication (< 11.0.1.1261) • veeam veeam backup \& replication 11.0.1.1261 • veeam veeam backup \& replication 12.0.0.1420

Weakness · CWE (1)

CWE-306 Missing Authentication for Critical Functionality weakness

References