How many CVEs does Veeam have?

Veeam has 88 published CVE records since 2015, including 27 in the last two years.

How many Veeam CVEs are in CISA KEV?

Yes — 4 of Veeam's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Veeam products have the most CVEs?

The Veeam products with the most published CVEs are Veeam Backup & Replication, Backup and Replication, One, Backup and Recovery, Backup & Replication.

What are the most common weakness types in Veeam CVEs?

Veeam's CVEs most often map to these CWE weakness types: CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-502 (Deserialization of Untrusted Data), CWE-284 (Improper Access Control), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Are there public exploits for Veeam vulnerabilities?

Yes — 14 of Veeam's CVEs have a known public exploit.

How many critical Veeam vulnerabilities are there?

Veeam has 28 critical and 42 high-severity CVEs.

What is the average severity of Veeam CVEs?

The average CVSS base score across Veeam's scored CVEs is 8.0.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

88 CVEs

4 in CISA KEV

Veeam Vulnerabilities

Name: Veeam vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Veeam.

88

Total CVEs

Published

4

In CISA KEV

Exploited in the wild

14

Public exploits

PoC or exploit code

8.0

Avg CVSS

2015–2026

Overview

Veeam has 88 published CVE records since 2015, of which 4 are in CISA's Known Exploited Vulnerabilities catalog and 14 have a known public exploit. The average CVSS base score across scored CVEs is 8.0.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Veeam products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Veeam's vulnerability posture, as a share of its 88 published CVEs.

Average CVSS: 8.0
Critical / high: 80%
Actively exploited (KEV): 5%
Public exploit available: 16%
Patch available: 90%

Severity and exploitation

How the CVSS severity of Veeam's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical28

High42

Medium16

Low2

In CISA’s Known Exploited Vulnerabilities catalog

4

4 of Veeam's CVEs are confirmed exploited in the wild.

Public exploits

14

14 of Veeam's CVEs have a known public exploit available.

Most affected products

The Veeam products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Veeam CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Veeam CVE records.

Disclosure activity by year

How many Veeam CVEs were published each year.

2019

3

2020

5

2021

1

2022

6

2023

5

2024

40

2025

9

2026

18

Latest Veeam CVEs

The most recently disclosed vulnerabilities affecting Veeam.

High vulnerability · 2026-07-22
CWE-22
High · CVSS 8.4
EPSS 0.1%2026-07-22
Critical vulnerability · 2026-06-09
CWE-502
Critical · CVSS 9.4
EPSS 2.4%2026-06-09
Critical vulnerability · 2026-05-28
CWE-233
Critical · CVSS 9.4
EPSS 0.4%2026-05-28
High vulnerability · 2026-05-28
CWE-36
High · CVSS 8.6
EPSS 0.5%2026-05-28
High vulnerability · 2026-05-28
CWE-532
High · CVSS 7.3
EPSS 0.2%2026-05-28
Medium vulnerability · 2026-04-17
CWE-77
Medium · CVSS 6.7
EPSS 0.2%2026-04-17
Critical vulnerability · 2026-03-12
CWE-89
Critical · CVSS 9.9
EPSS 1.1%2026-03-12
High vulnerability · 2026-03-12
CWE-538
High · CVSS 8.8
EPSS 0.2%2026-03-12
High vulnerability · 2026-03-12
CWE-693
High · CVSS 8.8
EPSS 0.5%2026-03-12
Critical vulnerability · 2026-03-12
CWE-693
Critical · CVSS 10.0
EPSS 1.2%2026-03-12
Critical vulnerability · 2026-03-12
CWE-693
Critical · CVSS 9.1
EPSS 1.3%2026-03-12
High vulnerability · 2026-03-12
CWE-522
High · CVSS 7.7
EPSS 0.4%2026-03-12

Track new Veeam CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Veeam CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Fujitsu88 CVEs 1000projects88 CVEs OISF88 CVEs otfcc project88 CVEs Pandora FMS88 CVEs pickplugins88 CVEs siyuan-note88 CVEs Tips and Tricks HQ88 CVEs

Browse all vendors

Frequently asked questions

Common questions about Veeam vulnerabilities.

How many CVEs does Veeam have?: Veeam has 88 published CVE records since 2015, including 27 in the last two years.
How many Veeam CVEs are in CISA KEV?: Yes — 4 of Veeam's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Veeam products have the most CVEs?: The Veeam products with the most published CVEs are Veeam Backup & Replication, Backup and Replication, One, Backup and Recovery, Backup & Replication.
What are the most common weakness types in Veeam CVEs?: Veeam's CVEs most often map to these CWE weakness types: CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-502 (Deserialization of Untrusted Data), CWE-284 (Improper Access Control), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Are there public exploits for Veeam vulnerabilities?: Yes — 14 of Veeam's CVEs have a known public exploit.
How many critical Veeam vulnerabilities are there?: Veeam has 28 critical and 42 high-severity CVEs.
What is the average severity of Veeam CVEs?: The average CVSS base score across Veeam's scored CVEs is 8.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Veeam vulnerabilities

Monitor new Veeam vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing