Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest
Oops! Something went wrong. Please, try again later.
Oops! Something went wrong.
Please, try again later.
A vulnerability that causes guest OS credentials used for Application Aware processing to be recorded in cleartext in logs on the guest machine.
Severity: Medium CVSS v4.0 Score: 6.8 CVSS: AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Affected Deployment Type: Windows-based Veeam Backup & Replication | Veeam Software Appliance Source: Reported through HackerOne.
Veeam Backup & Replication 13.0.2.29 and all earlier version 13 builds . Note: Older versions (e.g., 12.x) are not affected.
This vulnerability was fixed starting in the following builds:
Veeam Backup & Replication 13.1 (build 13.1.0.411)
Veeam Backup & Replication 13.0.3 (build 13.0.3.63)
A vulnerability allowing an authenticated Veeam Cloud Connect tenant to read arbitrary files on the service provider host.
Severity: High CVSS v4.0 Score: 8.3 CVSS: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Affected Deployment Type: Windows-based Veeam Backup & Replication Source: Reported through HackerOne.
Veeam Backup & Replication 13.0.2.29 and all earlier version 13 builds .
Veeam Backup & Replication 12.3.2.4854 and all earlier versions of 12 builds . Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable.
This vulnerability was fixed starting in the following builds:
Veeam Backup & Replication 13.1 (build 13.1.0.411)
Veeam Backup & Replication 13.0.3 (build 13.0.3.63)
Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934)
A vulnerability that allows an attacker to trigger a denial-of-service condition affecting processes on the affected system.
Severity: Medium CVSS v4.0 Score: 6.8 CVSS: AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Source: Reported through HackerOne.
Veeam Agent for Microsoft Windows 13.0.4.1341 and all earlier version 13 and 6 builds . Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable.
This vulnerability was fixed starting in the following build:
Veeam Agent for Microsoft Windows 13.1 (build 13.1.0.544)
A vulnerability allowing a local user to write arbitrary files as SYSTEM by manipulating mount points and symbolic links during installation.
Severity: Medium CVSS v4.0 Score: 4.1 CVSS: AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Source: Reported through HackerOne.
Veeam Agent for Microsoft Windows 13.0.4.1341 and all earlier version 13 and 6 builds . Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable.
This vulnerability was fixed starting in the following builds:
Veeam Agent for Microsoft Windows 13.1 (build 13.1.0.544)
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
Spelling error in text
Your feedback has been received and will be reviewed.
Oops! Something went wrong.
Please, try again later.
You have selected too large block!
Please try select less .
KB Feedback/Suggestion
This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
Your feedback has been received and will be reviewed.
Oops! Something went wrong. Please, try again later.
Oops! Something went wrong.
Please, try again later.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
