Virtualization and backup: vulnerabilities and fixes

VMware, Hyper-V, Veeam, Commvault and storage. 77 CVEs tracked.

Virtualization and backup has 77 tracked vulnerabilities, 11 critical. A fixed release or vendor patch exists for 32. Most recent: 2026-10-23. Highest priority: CVE-2026-67261 (score 63/100).

• CVE-2026-67261 CRITICAL 9.8 UPGRADE Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Comma
• CVE-2026-47865 CRITICAL 9.8 UPGRADE VMware Avi Load Balancer contains an authentication bypass vulnerability
• CVE-2026-13738 CRITICAL 9.8 UPGRADE CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operati
• CVE-2026-54489 CRITICAL 9.1 UPGRADE Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive
• CVE-2026-13737 CRITICAL 9.8 UPGRADE CommServe contained an allowlist bypass vulnerability affecting command execution authorization
• CVE-2026-71190 HIGH 8.7 In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnera
• CVE-2026-13739 CRITICAL 9.8 UPGRADE A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerabil
• CVE-2026-47871 HIGH 8.8 UPGRADE VMware Avi Load Balancer contains a directory traversal vulnerability
• CVE-2026-58067 HIGH 8.7 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory
• CVE-2026-71193 CRITICAL 9.6 In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone
• CVE-2026-71195 CRITICAL 9.9 In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the call
• CVE-2026-47867 HIGH 8.7 UPGRADE VMware Avi Load Balancer contains a remote code execution vulnerability
• CVE-2026-47869 HIGH 8.7 UPGRADE VMware Avi Load Balancer contains a remote code execution vulnerability
• CVE-2026-58073 CRITICAL 9.5 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a manage
• CVE-2026-58072 CRITICAL 9.0 A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, whic
• CVE-2026-16033 HIGH 8.5 UPGRADE A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained
• CVE-2026-58071 HIGH 8.2 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied a
• CVE-2026-71130 HIGH 8.2 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2025-64393 CRITICAL 9.4 This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on
• CVE-2026-71113 HIGH 7.5 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71194 MEDIUM 6.8 In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queri
• CVE-2026-47866 HIGH 8.3 UPGRADE VMware Avi Load Balancer contains an authorization bypass vulnerability
• CVE-2026-66138 HIGH 7.2 In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbit
• CVE-2026-47870 HIGH 7.1 UPGRADE VMware Avi Load Balancer contains a privilege escalation vulnerability
• CVE-2026-55707 HIGH 7.1 In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subn
• CVE-2026-13622 HIGH 8.8 A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy
• CVE-2026-71191 MEDIUM 6.0 In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered
• CVE-2026-66139 MEDIUM 4.8 OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.
• CVE-2026-71131 HIGH 8.6 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-56844 HIGH 8.4 A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user t
• CVE-2026-71129 HIGH 8.2 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71192 MEDIUM 6.0 In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy
• CVE-2026-47047 HIGH 7.8 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-47054 HIGH 7.8 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-60150 HIGH 7.8 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-47868 HIGH 7.8 UPGRADE VMware Avi Load Balancer contains a local privilege escalation vulnerability
• CVE-2026-71126 HIGH 7.8 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71141 HIGH 7.7 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-47050 HIGH 7.4 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-60155 HIGH 7.5 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-60159 HIGH 7.5 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71116 HIGH 7.5 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71136 HIGH 7.3 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71138 HIGH 7.3 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-12080 HIGH 7.3 A flaw was found in the QEMU Guest Agent (qga)
• CVE-2026-4793 HIGH 7.3 UPGRADE An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to
• CVE-2026-64635 MEDIUM 5.3 Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console
• CVE-2026-90458 MEDIUM 5.4 OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BM
• CVE-2026-60158 MEDIUM 6.4 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71114 MEDIUM 6.0 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71115 MEDIUM 6.0 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-89419 MEDIUM 5.0 OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH t
• CVE-2026-47041 MEDIUM 6.0 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-60161 MEDIUM 6.1 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-60162 MEDIUM 6.1 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71125 MEDIUM 6.1 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71127 MEDIUM 6.0 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71128 MEDIUM 6.0 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71135 MEDIUM 6.0 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71137 MEDIUM 6.0 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71201 MEDIUM 5.0 In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgro
• CVE-2026-71134 MEDIUM 5.7 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-93856 MEDIUM 4.3 In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API
• CVE-2026-47044 MEDIUM 5.5 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-47053 MEDIUM 5.6 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-47062 MEDIUM 5.5 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-54422 MEDIUM 5.5 In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-pytho
• CVE-2026-71151 MEDIUM 5.6 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71132 MEDIUM 5.3 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-115638 MEDIUM 4.3 OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amou
• CVE-2026-71139 MEDIUM 4.4 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-47043 LOW 3.2 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-60160 LOW 3.2 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71140 LOW 3.4 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-47055 LOW 3.2 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-98900 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before
• CVE-2026-99057 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xen

FAQ

How do I fix Virtualization and backup vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Virtualization and backup being exploited right now?

None of the tracked Virtualization and backup CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Virtualization and backup CVE should I patch first?

CVE-2026-67261 currently ranks highest (63/100): Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Comma.

Software in this group

People search for: vmware, esxi, vcenter, backup, veeam.

← Back to latest CVEs