What’s Vulnerable › Vulnerabilities

CVE-2023-27532: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-08-22
• EPSS: 80.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-10 · updated 2026-06-17
• Weakness: CWE-306

Description

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.

Summary

CVE-2023-27532 is a missing authentication flaw in the Veeam Backup & Replication Cloud Connect component that lets an attacker retrieve encrypted credentials stored in the configuration database, potentially leading to access to backup infrastructure hosts. It affects Veeam Backup & Replication and is fixed in 11.0.1.1261. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS estimates an 80.6% probability of exploitation within 30 days. Apply the vendor mitigations or upgrade to 11.0.1.1261, and discontinue use of the product if mitigations are unavailable.

CVE-2023-27532 ثغرة نقص في المصادقة ضمن مكوّن Cloud Connect في Veeam Backup & Replication تتيح للمهاجم الحصول على بيانات الاعتماد المشفّرة المخزّنة في قاعدة بيانات الإعدادات، مما قد يؤدي إلى الوصول إلى مضيفات البنية التحتية للنسخ الاحتياطي. تؤثر الثغرة في Veeam Backup & Replication وقد تم إصلاحها في الإصدار 11.0.1.1261. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع استغلال نشط، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 80.6%. طبّق إرشادات التخفيف من المورّد أو قم بالترقية إلى 11.0.1.1261، وتوقّف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف.

Affected products

• Veeam Backup & Replication: before 11.0.1.1261; 11.0.1.1261, 11.0.1.1261-p20211123, 11.0.1.1261-p20211211, 11.0.1.1261-p20220302, 12.0.0.1420 — fixed in 11.0.1.1261

How to fix

Upgrade to a fixed version: Veeam Backup & Replication 11.0.1.1261. Check the vendor advisory for mitigations.

References

• https://www.veeam.com/kb4424
• https://www.veeam.com/kb4424
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27532

Get alerted when CVE-2023-27532 or the next vulnerability affects your stack