Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-58073exploit | 9.5 critical | 0.00% | no CPE yet | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials. | Sat 24 Oct |
| CVE-2026-32996exploit | 7.3 high | 0.00% | no CPE yet | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. | Mon 26 Oct |
| CVE-2025-64393 | 9.4 critical | 5.0% | no CPE yet | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server. | Sat 24 Oct |
| CVE-2026-32998 | 9.4 critical | 1.0% | no CPE yet | This vulnerability in Veeam Service Provider Console allows for remote code execution. | Mon 26 Oct |
| CVE-2026-58072 | 9.0 critical | 1.0% | no CPE yet | A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution. | Sat 24 Oct |
| CVE-2026-32997 | 8.6 high | 1.0% | no CPE yet | A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server. | Mon 26 Oct |
| CVE-2023-22793 | 9.3 critical | — | veeam, management pack for microsoft system center | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center. | 6 h ago |
| CVE-2026-106076 | 9.0 critical | 0.00% | no CPE yet | A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account. | Wed 28 Oct |
| CVE-2026-107239 | 8.8 high | — | veeam, management pack for microsoft system center | A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service. | 6 h ago |
| CVE-2026-107238 | 8.7 high | — | veeam, management pack for microsoft system center | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service. | 6 h ago |
| CVE-2026-58067 | 8.7 high | 0.00% | no CPE yet | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service. | Sat 24 Oct |
| CVE-2026-56844 | 8.4 high | 0.00% | no CPE yet | A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system. | Sat 24 Oct |
| CVE-2026-106077 | 8.3 high | 0.00% | no CPE yet | A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges. | Wed 28 Oct |
| CVE-2026-58071 | 8.2 high | 0.00% | no CPE yet | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins. | Sat 24 Oct |
| CVE-2026-105477 | 7.3 high | 0.00% | no CPE yet | A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected. | Wed 28 Oct |
| CVE-2026-106078 | 6.9 medium | 0.00% | no CPE yet | A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service. | Wed 28 Oct |
| CVE-2026-64635 | 5.3 medium | 0.00% | no CPE yet | Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account. | 23 Oct |
| CVE-2025-64392 | 4.8 medium | 0.00% | no CPE yet | This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link. | 19 Oct |
| CVE-2025-64394 | 4.3 medium | 0.00% | no CPE yet | A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service. | Wed 28 Oct |
| CVE-2025-64391 | 4.1 medium | 0.00% | no CPE yet | This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it. | 19 Oct |
20 of 20
Download these 20 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.