CVE-2023-27532 Known ransomware use

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

Veeam — Backup & Replication

Added to KEV catalog: 22 August 2023
Federal remediation due date: 12 September 2023
Weakness classification (CWE): CWE-306

CISA Description

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://www.veeam.com/kb4424; https://nvd.nist.gov/vuln/detail/CVE-2023-27532

View on NVD View on MITRE CVE View full CISA catalog

More Veeam Vulnerabilities

CVE-2024-40711

Veeam Backup and Replication Deserialization Vulnerability

CVE-2022-26500

Veeam Backup & Replication Remote Code Execution Vulnerability

CVE-2022-26501

Veeam Backup & Replication Remote Code Execution Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services