CVE-2023-27532
Attackers can obtain encrypted credentials and access backup infrastructure hosts in Veeam Backup & Replication.
This flaw in Veeam Backup & Replication lets an attacker obtain encrypted credentials stored in the configuration database, meaning the database where the product keeps saved credentials. That can lead to access to the backup infrastructure hosts. CISA has added the vulnerability to its known-exploited list, so attackers are actively using it; the record lists no fixed version and CISA told US federal agencies to fix it by 2023-09-12.
Veeam Backup & Replication · Updated 28 Oct · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 22 Aug; US agencies must fix by 12 Sept. Used by ransomware gangs
SeverityhighCVSS 7.5 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Treat this as actively exploited and look for signs of unauthorized access because CISA has placed it on its known-exploited list.
- Apply a fixed version from Veeam if one is available; the record does not name a fixed version.
- If you are a US federal agency, remediate by 2023-09-12 as CISA requires.
- No workaround is given in the record or the story, so monitor vendor and CISA guidance for remediation.
What happened
- 22 AugCISA added the Veeam Backup & Replication vulnerability to its known-exploited list.
- 12 SeptCISA set this date as the deadline for US federal agencies to fix the vulnerability.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2023-27532 | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | high 7.5 | 22 Aug | 81% |
Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works