This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Veeam fixes 3 vulnerabilities
Veeam fixes 3 vulnerabilities in Veeam Service Provider Console and Veeam Backup & Replication [1][2]. Individual products and their fixed versions: Veeam Service Provider Console - 9.2.1.33875 [1] Veeam Backup & Replication - 13.0.2.29 [2]
An authenticated remote attacker can execute arbitrary code in Veeam Service Provider Console [1].
The vulnerability is present in product:
- Veeam Service Provider Console; >=9.0, <9.2.1.33875
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
More information:
- CVE-2026-32998 at cve.org, NVD
- CWE-233: Improper Handling of Parameters at cwe.mitre.org
The vulnerability was publicly disclosed 27. 5. 2026.
An authenticated remote attacker with Backup Administrator privileges can write arbitrary files on the Veeam Backup & Replication server (Linux) [2].
The vulnerability is present in product:
- Veeam Backup & Replication; >=13.0, <13.0.2.29
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2026-32997 at cve.org, NVD
- CWE-36: Absolute Path Traversal at cwe.mitre.org
The vulnerability was publicly disclosed 27. 5. 2026.
An authenticated local attacker can elevate their privileges due to a vulnerability in Veeam Agent for Microsoft Windows [2].
The vulnerability is present in product:
- Veeam Backup & Replication; >=13.0, <13.0.2.29
CVSS: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N
More information:
- CVE-2026-32996 at cve.org, NVD
- CWE-532: Insertion of Sensitive Information into Log File at cwe.mitre.org
The vulnerability was publicly disclosed 27. 5. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 29. 5. 2026.