Veeam Knowledge Base (security bulletins)
veeam-kb-security · A · candidate
https://www.veeam.com/knowledge-base.html?type=security
Added 2026-10-29 (S1): first-party PSIRT for backup infrastructure, a target class for ransomware operators; the KB RSS feed lists the 'Vulnerabilities Resolved in ...' bulletins (KB4948, KB4951, KB4957 of 2026-10-27) on the day of publication and is the primary of the Veeam entry of this run. `extract` of a KB page drops the CVE headings, so read CVE ids and fixed builds with the raw `url` subcommand. Candidate: promote to active after 3 contributing runs.
Cited in 5 entries
Citation cadence
Citation days per ISO week (23 weeks of coverage span, total 4).
- CVE-2026-108142, Veeam Backup & Replication: an unauthenticated authorization bypass on the CDP Coordinator Service of 13.x backup servers (CVSS 4.0 9.1), fixed in 13.1.2 and 13.0.3, with a Backup for Microsoft 365 SQL injection to code execution and a Veeam ONE MFA bypass fixed the same day2026-10-29
- Veeam Service Provider Console and Veeam ONE, ten CVEs, headed by an unauthenticated CVSS 10.0 remote code execution on the Veeam ONE agent host2026-08-06
- CVE-2026-47344 et al. TYPO3 core June release: 13 CVEs across every supported branch (10.4 ELTS → 14.3 LTS)2026-06-10
- CVE-2026-44963, Veeam Backup & Replication: authenticated domain-user deserialization RCE on the backup server (CVSS 9.4)2026-06-10
- CVE-2026-32996 & CVE-2026-32997, Veeam Backup & Replication KB4852: LPE in Windows Agent, arbitrary file write in Linux appliance2026-05-29