How many Veeam Backup and Recovery CVEs are in CISA KEV?

Yes — 1 of Veeam Backup and Recovery's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which versions of Veeam Backup and Recovery are affected?

8 distinct Veeam Backup and Recovery versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Veeam Backup and Recovery CVEs?

Veeam Backup and Recovery's CVEs most often map to these CWE weakness types: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')), CWE-502 (Deserialization of Untrusted Data), CWE-269 (Improper Privilege Management), CWE-287 (Improper Authentication).

How many critical Veeam Backup and Recovery vulnerabilities are there?

Veeam Backup and Recovery has 5 critical and 9 high-severity CVEs.

What is the average severity of Veeam Backup and Recovery CVEs?

The average CVSS base score across Veeam Backup and Recovery's scored CVEs is 8.5.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Veeam

14 CVEs

1 in CISA KEV

Veeam Backup and Recovery Vulnerabilities

Name: Veeam Backup and Recovery vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Backup and Recovery by Veeam.

14

Total CVEs

Published

1

In CISA KEV

Exploited in the wild

2

Public exploits

PoC or exploit code

8.5

Avg CVSS

2024–2026

Last updated January 8, 2026

Overview

Veeam Backup and Recovery has 14 published CVE records since 2024, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 2 have a known public exploit. The average CVSS base score across scored CVEs is 8.5.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Veeam Backup and Recovery, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Veeam Backup and Recovery's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical5

High9

Medium0

Low0

In CISA’s Known Exploited Vulnerabilities catalog

1

One of Veeam Backup and Recovery's CVEs is confirmed exploited in the wild.

Public exploits

2

2 of Veeam Backup and Recovery's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Veeam Backup and Recovery version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

12.1.2 <= v <= 12.1.27 CVEs
13.0.0 <= v <= 13.0.04 CVEs
12.3 <= v <= 12.32 CVEs
12.3.1 <= v <= 12.3.11 CVE

Fixed in

> 12.1.27 CVEs
> 13.0.04 CVEs
> 12.32 CVEs
> 12.3.11 CVE

Find a version

14 CVEs

Sort

Critical vulnerability · 2026-01-08
CVE-2025-59468
Patch
CWE-77
Critical · CVSS 9.1
EPSS 1.1% (63th pct)2026-01-08
Critical vulnerability · 2026-01-08
CVE-2025-55125
Patch
CWE-77
Critical · CVSS 9.8
EPSS 0.8% (53th pct)2026-01-08
Critical vulnerability · 2026-01-08
CVE-2025-59469
Patch
CWE-200
Critical · CVSS 9.0
EPSS 0.6% (46th pct)2026-01-08
Critical vulnerability · 2026-01-08
CVE-2025-59470
Public exploit
Patch
CWE-77
Critical · CVSS 9.0
EPSS 1.5% (71th pct)2026-01-08
High vulnerability · 2025-06-18
CVE-2025-24286
Patch
CWE-269
High · CVSS 7.2
EPSS 11.6% (96th pct)2025-06-18
High vulnerability · 2025-06-18
CVE-2025-23121
Patch
CWE-94
High · CVSS 8.8
EPSS 17.5% (97th pct)2025-06-18
High vulnerability · 2025-03-20
CVE-2025-23120
Patch
CWE-502
High · CVSS 8.8
EPSS 22.0% (97th pct)2025-03-20
High vulnerability · 2024-09-07
CVE-2024-40714
Patch
CWE-295
High · CVSS 8.3
EPSS 0.3% (26th pct)2024-09-07
High vulnerability · 2024-09-07
CVE-2024-40713
Patch
CWE-287
High · CVSS 7.8
EPSS 0.3% (24th pct)2024-09-07
High vulnerability · 2024-09-07
CVE-2024-40709
Patch
CWE-862
High · CVSS 7.8
EPSS 0.2% (9th pct)2024-09-07
Critical vulnerability · 2024-09-07
CVE-2024-40711
CISA KEV
Public exploit
Patch
CWE-502
Added to CISA KEV 2024-10-17
Critical · CVSS 9.3
EPSS 90.4% (100th pct)2024-09-07
High vulnerability · 2024-09-07
CVE-2024-40712
Patch
CWE-22
High · CVSS 7.8
EPSS 0.3% (21th pct)2024-09-07
High vulnerability · 2024-09-07
CVE-2024-40710
Patch
CWE-522
High · CVSS 8.8
EPSS 1.1% (63th pct)2024-09-07
High vulnerability · 2024-09-07
CVE-2024-39718
Patch
High · CVSS 8.1
EPSS 0.8% (54th pct)2024-09-07

Common weakness types

The CWE weakness categories most often found in Veeam Backup and Recovery CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Veeam Backup and Recovery CVEs were published each year.

2024

7

2025

3

2026

4

Other Veeam products

Browse vulnerabilities for other products by Veeam.

veeam backup & replication42 CVEs Backup and Replication17 CVEs one14 CVEs Backup & Replication13 CVEs service_provider_console9 CVEs backup_\&_replication6 CVEs Veeam Service Provider Console6 CVEs agent4 CVEs

All Veeam vulnerabilities

Frequently asked questions

Common questions about Veeam Backup and Recovery vulnerabilities.

How many CVEs does Veeam Backup and Recovery have?: Veeam Backup and Recovery has 14 published CVE records since 2024.
How many Veeam Backup and Recovery CVEs are in CISA KEV?: Yes — 1 of Veeam Backup and Recovery's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for Veeam Backup and Recovery vulnerabilities?: Yes — 2 of Veeam Backup and Recovery's CVEs have a known public exploit.
Which versions of Veeam Backup and Recovery are affected?: 8 distinct Veeam Backup and Recovery versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Veeam Backup and Recovery CVEs?: Veeam Backup and Recovery's CVEs most often map to these CWE weakness types: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')), CWE-502 (Deserialization of Untrusted Data), CWE-269 (Improper Privilege Management), CWE-287 (Improper Authentication).
How many critical Veeam Backup and Recovery vulnerabilities are there?: Veeam Backup and Recovery has 5 critical and 9 high-severity CVEs.
What is the average severity of Veeam Backup and Recovery CVEs?: The average CVSS base score across Veeam Backup and Recovery's scored CVEs is 8.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Veeam Backup and Recovery vulnerabilities

Monitor new Veeam Backup and Recovery vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing