Critical VEEAM Backup Vulnerability

Multiple critical vulnerabilities are affecting several Veeam products.

On September 4, 2024, Veeam released a security bulletin addressing several vulnerabilities impacting various Veeam products; three of which are classified as critical.

Vulnerability CVSS Affected Product Description:

Currently, no active exploitation or publicly available proof of concept (PoC) exploit code has been observed, however, given the history of ransomware targeting Veeam products, it’s crucial to act swiftly.

TSI’s Proposed Next Steps

We strongly recommend that you apply the necessary patches and updates to mitigate these risks as soon as possible. The latest fixed versions are as follows:

· Veeam Backup and Replication: v12.2 (build 12.2.0.334)

· Veeam ONE: v12.2 (build 12.2.0.4093)

· Veeam Service Provider Console: v8.1 (build 8.1.0.21377)