The updater component of Veeam Backup & Replication contains a vulnerability that attackers can exploit to escalate their privileges within the system. An update has been available since last week.
In a security advisory, manufacturer Veeam explains that due to a vulnerability in the Veeam updater component, local users can escalate their privileges and gain root access, thereby obtaining access to the operating system (CVE-2026-56844, CVSS4 8.4 , risk “ high ”). The corresponding vulnerability entry, CVE-2026-56844, was published on Wednesday night.
The updater components of the Veeam Software Appliance (Linux-based Veeam Backup and Replication server) and the Veeam Infrastructure Appliance are affected. The developers point out that the Windows-based Veeam Backup & Replication servers are not directly impacted, but remote components that use the Veeam Infrastructure Appliance may be vulnerable.
Last Tuesday, Veeam's developers released version 12.3.0.65 of the Veeam updater component, which closes the vulnerability. Most users will not need to do anything if they have enabled automatic update distribution. In that case, the mechanism has already transferred the update to the system. If the software or infrastructure appliance cannot reach Veeam's repository or a local mirror of it, administrators must install the fix manually. To achieve this, they should Veeam support or temporarily enable access to the update servers.
To check if the update component is current, administrators must open the web interface of the host management console. Under “Logs and Services” on the left side, they will find the “Components” tab. A filter can be entered there, such as “Updater.” Among the results, “Veeam Updater” should appear, showing version 12.3.0.65 or newer.
Most recently, Veeam had to distribute security updates at the end of May to fix vulnerabilities in Veeam Backup & Replication on both Linux and Windows.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
