Veeam Security Update – 05 September 2024

The addressed vulnerabilities could allow the attacker to upload malicious files, obtain sensitive information, manipulate data and files, obtain credentials, gain elevated privileges, execute malicious commands, and gain access to the affected products.

Sample of the addressed vulnerabilities:

1. Veeam VSPC Server Privilege Escalation Vulnerability (CVE-2024-38650):

• CVSS: 9.9
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Privileges

2. Veeam Server Remote Code Execution Vulnerability (CVE-2024-39714):

• CVSS: 9.9
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Access

Affected products:

• Veeam Backup & Replication.
• Veeam ONE.
• Veeam Service Provider Console.
• Veeam Agent for Linux.
• Veeam Backup for Nutanix AHV.
• Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization.