It shouldn’t be news to you that Veeam B&R had 2 critical vulnerabilities (CVSS 9.8/8.8) in March 2022. Patches were released for v10a and v11a at that time.
Here’s the corresponding KB article and a post from
If you haven’t updated yet, then here’s another good reason.
Last week the Cybersecurity & Infrastructure Security Agency (CISA) added both vulnerabilites to their known exploit catalog. This means that attackes are now actively exploiting the vulnerabilities and targeting environments which use Veeam B&R.
CISA Known Exploited Vulnerabilites Catalog
I hope you don’t need more reasons to keep your Veeam installation up-to-date? Please also keep in mind that any other Veeam build below v10 is also affected. But as those are already End of Fix/Support, they didn’t receive any patches.
