Granular sudo Permissions for Veeam Plug-in for Proxmox VE

Purpose This article provides an example granular 'sudoers' configuration for the Linux account that will be used by Veeam Backup & Replication when managing a Proxmox VE host. Solution Critical Details Before You Begin Review all Considerations and Limitations in the user guide! Most noteworthy:...

The vulnerability of the Veeam Updater, a component of backup and recovery tools such as Veeam Backup for Salesforce, Veeam Backup for Nutanix AHV, and Veeam Backup for AWS, allows a perpetrator to carry out a “man-in-the-middle” attack.

The vulnerability of the Veeam Updater, a component of backup and recovery tools such as Veeam Backup for Salesforce, Veeam Backup for Nutanix AHPV, and Veeam Backup for AWS, relates to access to a channel from a non-endpoint location. Exploiting this vulnerability allows a remote attacker to...

Vulnerability fixed in Veeam

Veeam has fixed a vulnerability in the Veeam Updater component. The vulnerability is in how the Veeam Updater component validates TLS certificates. Insufficient validation can allow Man-in-the-Middle attackers to execute arbitrary code on affected servers. This can lead to unauthorized access and...

Veeam ONE Report Error "Invalid query string"

Note to Veeam Backup for Microsoft 365 Customers If you were directed here by the output of the Test-VBORepository cmdlet, please visit https://www.veeam.com/kb4704. The typo in the cmdlet output will be corrected in a future release. Challenge When previewing a report in Veeam ONE Web Client, th...

How to upgrade Veeam Backup for Salesforce to version 2.1.1.

Challenge Customers who installed Veeam Backup for Salesforce 2.x on the following distros before April 2024 won't see the upgrade notification in the product due to the expiration of GPG keys and must perform the upgrade manually. CentOS 7 Red Hat Enterprise Linux 7 Oracle Linux 7 Solution...

CVE-2025-23082

Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2020-15418

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.75020200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSRSReport class. Due to the improper restriction of XML Extern...

CVE-2020-15419

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.75020200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ReporterImportLicense class. Due to the improper restriction of...

New Veeam Flaw Allows Arbitrary Code Execution via Man-in-the-Middle Attack

Veeam has released patches to address a critical security flaw impacting its Backup software that could allow an attacker to execute arbitrary code on susceptible systems. The vulnerability, tracked as CVE-2025-23114 , carries a CVSS score of 9.0 out of 10.0. "A vulnerability within the Veeam...

CVE-2024-29853

An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation...

CVE-2024-29855

Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator...

CVE-2024-29851

Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account...

CVE-2024-29849

Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface...

CVE-2024-29212

Due to an unsafe de-serialization method used by the Veeam Service Provider ConsoleVSPC server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution RCE on the VSPC server machine...

CVE-2024-29850

Veeam Backup Enterprise Manager allows account takeover via NTLM relay...

CVE-2024-45207

DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. When the agent runs, it searches these directories for necessary DLLs. If an attacker places a malicious DLL in one of these directories, the Veeam Agent might load it inadvertently,...

CVE-2024-42456

A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuration settings, such as modifying the trusted client certificate used for authentication on a specific port. This can result in unauthorized...

CVE-2024-42452

A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escalating privileges to system-level access. This allows the attacker to upload files to the server with elevated privileges. The vulnerability...

CVE-2024-42457

A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading ...

CVE-2024-42453

A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability to power off virtual machines, delete files in storage, and make configuration changes, potentially leading to Denial of...