CVE-2023-27532: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , 165 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 80.6%
EPSS score, percentile 99.6 of all scored records
- How severe?
- 7.5 High
CVSS v3.1 base score, from CISA's enrichment of the record
- What should I do?
CISA deadline . Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- Fixed Versions: v12 (build 12.0.0.1420 P20230223)
- 11a (build 11.0.1.1261 P20230227)
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
What to do
Required action, set by CISA
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date for this action: .
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | Fixed Versions: v12 (build 12.0.0.1420 P20230223) |
| Affected | 11a (build 11.0.1.1261 P20230227) |
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
About this vulnerability
Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.
Summary: CISA's KEV catalog, as of .
- CISA added CVE-2023-27532 to its Known Exploited Vulnerabilities (KEV) catalog on 22 Aug 2023.
- CISA marks it as known to be used in ransomware campaigns.
- The due date CISA sets for the required action is 12 Sep 2023.
- The CVE record was published on 10 Mar 2023, 165 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 7.5 (High), taken from CISA's enrichment of the record.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 80.6% (percentile 99.6), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact partial.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
Description
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
Weakness
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| Added to CISA KEV | |
| CISA due date for the required action | |
| CVE record last updated |
References
More exploited Veeam vulnerabilities
- CVE-2024-40711: Veeam Backup and Replication Deserialization Vulnerability
- CVE-2022-26500: Veeam Backup & Replication Remote Code Execution Vulnerability
- CVE-2022-26501: Veeam Backup & Replication Remote Code Execution Vulnerability