Veeam vulnerabilities and fixes

CVEs that mention Veeam, ranked by priority. 5 tracked.

Veeam has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-08-04. Highest priority: CVE-2026-58067 (score 45/100).

• CVE-2026-58067 HIGH 8.7 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory
• CVE-2026-58073 CRITICAL 9.5 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a manage
• CVE-2026-58072 CRITICAL 9.0 A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, whic
• CVE-2026-58071 HIGH 8.2 A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied a
• CVE-2026-64635 MEDIUM 5.3 Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console

FAQ

How do I fix Veeam vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Veeam being exploited right now?

None of the tracked Veeam CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Veeam CVE should I patch first?

CVE-2026-58067 currently ranks highest (45/100): A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory .

← Back to latest CVEs