CloudSEK says that analysis by its contextual AI digital risk platform, XVigil, has discovered several critical and high-severity vulnerabilities affecting Veeam Backup & Replication.
Several threat actors were seen advertising a fully weaponized tool for remote code execution to exploit the vulnerabilities says CloudSEK.
The Veeam Backup & Replication vulnerabilities identified are:
- CVE-2022-26500 and CVE-2022-26501 with a CVSS V3 score of 9.8
- CVE-2022-26504 with a CVSS V3 score of 8.8
Threat actors can exploit the vulnerabilities to:
- Gain initial access
- Disclose sensitive information
- Perform DDoS attacks
- Encrypt the infrastructure with malware
- Gain privileges and execute arbitrary code remotely.
Installing the latest Veeam Backup & Replication update will mitigate the issues says CloudSEK.
