Horizon Alert
Summary of the vulnerability and why it matters
A flaw in Veeam Backup & Replication could allow unauthorized access to internal functions. This could enable attackers to upload and execute malicious code within an organization's systems. The impact can include unauthorized data access or modification and potential disruption of business operations.
- Vulnerable backup software
- Flaw allows code execution
- Business operations at risk
Attack Path
How an attacker could exploit the issue
This vulnerability affects Veeam Backup & Replication software, enabling remote authenticated users to access internal API functions. Attackers can leverage this access to upload and execute arbitrary code, potentially leading to unauthorized system control. The improper limitation of path names is the core issue exploited.
- Requires authenticated user access.
- Attacker uploads and executes code.
- Results in system control.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in Veeam Backup & Replication allows authenticated users to access internal API functions, potentially leading to the upload and execution of arbitrary code. This could result in unauthorized access and control over affected systems. The CISA known exploited vulnerabilities catalog lists this CVE.
- Low skill level required for attackers.
- Authenticated access to the system is needed.
- Business risk is high.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability allows remote authenticated users to access internal API functions, potentially leading to the upload and execution of arbitrary code. The impact could include unauthorized access, system compromise, and data loss for affected organizations. This issue is known to be exploited in ransomware campaigns.
- Find affected assets.
- Reduce exposure or isolate risk.
- Fix, verify, and monitor.
