https://pwn.watch/t/veeam Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 17 Oct 2024 00:00:00 GMT https://pwn.watch/i/veeam-backup-replication-cve-2024-40711 https://pwn.watch/i/veeam-backup-replication-cve-2024-40711 Thu, 17 Oct 2024 00:00:00 GMT critical <p>Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution. Added to the CISA KEV catalog on 2024-10-17. CISA lists known use in ransomware campaigns.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-10-17: CISA added CVE-2024-40711 to the KEV catalog (federal deadline 2024-11-07) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-09-07: CVE-2024-40711 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-40711">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-40711</p> https://pwn.watch/i/veeam-backup-replication-cve-2023-27532 https://pwn.watch/i/veeam-backup-replication-cve-2023-27532 Tue, 22 Aug 2023 00:00:00 GMT high <p>Veeam Backup &amp; Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts. Added to CISA KEV on 2023-08-22. CISA lists known use in ransomware campaigns.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2023-08-22: CISA added CVE-2023-27532 to the KEV catalog (due 2023-09-12).</li></ul> <p><strong>CVEs:</strong> CVE-2023-27532</p>