# CVE-2022-26501

Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

- Page: https://www.vulneraibility.com/cve/CVE-2022-26501
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-12-13; CISA due date 2023-01-03; known ransomware use
- EPSS: 4.10% (percentile 90.9)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-02-03)
- Weakness: CWE-306
- Published: 2022-03-17

## Affected

- veeam:veeam_backup_\&_replication

## References

- [other] https://veeam.com
- [other] https://www.veeam.com/kb4288
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26501

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.