CVE-2024-42453

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-04 · updated 2026-06-17
Weakness: CWE-862

Description

A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability to power off virtual machines, delete files in storage, and make configuration changes, potentially leading to Denial of Service (DoS) and data integrity issues. The vulnerability is caused by improper permission checks in methods accessed via management services.

Affected products

Veeam Backup & Replication: from 12.0.0.1402 before 12.3.0.310 — fixed in 12.3.0.310

How to fix

Upgrade to a fixed version: Veeam Backup & Replication 12.3.0.310. Check the vendor advisory for mitigations.

References

https://www.veeam.com/kb4693

Get alerted when CVE-2024-42453 or the next vulnerability affects your stack