{"id":"CVE-2022-26500","aliases":["EUVD-2022-31058","GHSA-2vw2-587w-g9v6"],"status":"published","title":"Improper limitation of path names in Veeam Backup \u0026 Replication 9.5U3, 9.5U4,10.x, and 11.x...","description":"Improper limitation of path names in Veeam Backup \u0026 Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.05828,"percentile":0.93253,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2022-03-17T20:56:44Z","modified":"2026-06-17T04:35:18Z","kev":{"date_added":"2022-12-13","due_date":"2023-01-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-12-13"},{"source":"kev","since":"2022-12-13"}],"products":[{"vendor":"veeam","product":"backup \u0026 replication"},{"vendor":"veeam","product":"veeam_backup_\\\u0026_replication"}],"references":[{"url":"https://veeam.com","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.veeam.com/kb4288","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26500","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26500"},{"url":"https://github.com/advisories/GHSA-2vw2-587w-g9v6"}],"sources":{"cve":[{"id":"CVE-2022-26500","description":"Improper limitation of path names in Veeam Backup \u0026 Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.","status":"published","published":"2022-03-17T20:56:44Z","modified":"2025-10-21T23:15:44.043Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:25.954329Z"}],"euvd":[{"id":"EUVD-2022-31058","description":"Improper limitation of path names in Veeam Backup \u0026 Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.","status":"published","published":"2022-03-17T20:56:44Z","modified":"2025-10-21T23:15:44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-12-13","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-2vw2-587w-g9v6","title":"Improper limitation of path names in Veeam Backup \u0026 Replication 9.5U3, 9.5U4,10.x, and 11.x...","description":"Improper limitation of path names in Veeam Backup \u0026 Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.","status":"published","published":"2022-03-18T00:01:08Z","modified":"2025-10-22T00:33:35Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:04:08.198655Z"}],"kev":[{"id":"CVE-2022-26500","title":"Veeam Backup \u0026 Replication Remote Code Execution Vulnerability","description":"The Veeam Distribution Service in the Backup \u0026 Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.","cwes":["CWE-22"],"kev":{"date_added":"2022-12-13","due_date":"2023-01-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-26500","description":"Improper limitation of path names in Veeam Backup \u0026 Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.","status":"published","published":"2022-03-17T21:15:08.193Z","modified":"2026-06-17T04:35:18.53Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:14.24948Z"}]}}