CVE-2022-26500

Vulnerability details

The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

Added to CISA KEV: 2022-12-13

Ransomware campaign use: Known

CISA due date: 2023-01-03

Defensive guidance from CISA

Apply updates per vendor instructions.

This is the source's required-action field, not an independently validated patch procedure. Refer to the vendor for exact affected versions and fixes.