CVE-2023-27532: Veeam Backup & Replication API Credential Disclosure

HERMES

HERMES THREAT SCORE & ENTERPRISE BACKUP ATTACK SURFACE

Target: Veeam Backup & Replication (Veeam.Backup.Service.exe / TCP 9401)

Confidence: 99%

91 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 18 / 20

Weaponization 20 / 20

Exposure 16 / 20

Prevalence 19 / 20

Impact 19 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2023-27532 at 7.5 (HIGH, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The Hermes Threat Score elevates operational risk to 91 (HIGH) reflecting extensive ransomware weaponization (FIN7, Akira, Medusa) and presence in offensive AI toolkits.

🕸️ Connected Knowledge Graph & Provenance

CVE-2023-27532: Veeam Backup Service API Credential DisclosureVULNERABILITY

Connected Nodes: 2

Active Relationships (Outgoing)

→ affectsPRODUCTVeeam Backup & Replication

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Veeam Backup & Replication documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1552: Unsecured Credentials

90% VERY_HIGH

Adversaries search compromise victims for unsecured credentials in files, environment variables, or memory.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1552.”

Supporting Verified Evidence:

• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

CISA KEV Vulnerability: Enterprise Backup Credential Theft

CVSS v3.1: 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) / CWE-306: Missing Authentication for Critical Function. Added to CISA KEV on August 22, 2023. Actively exploited across multiple ransomware campaigns and retained in the offensive toolkit of the AI-Orchestrated PaperCut Actor.

Executive Summary

CVE-2023-27532 is an unauthenticated credential disclosure vulnerability affecting Veeam Backup & Replication versions prior to 12.0.0.1420 P20230319 and 11.0.0.837 P20230321. An unauthenticated API endpoint exposed by default on TCP port 9401 allows remote attackers to query the internal configuration database, retrieving encrypted passwords for hypervisors, cloud storage, and domain administrator service accounts.

---

1. Technical Context & Affected Software Matrix

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2023-27532	Veeam Security Advisory KB4424 & CISA KEV
Affected Product	veeam:backup_and_replication	Enterprise Backup, Recovery & Disaster Recovery Platform
Vulnerable Component	Veeam Backup Service (TCP 9401)	.NET Remoting / WCF Service Endpoint
Weakness Class	CWE-306: Missing Authentication for Critical Function	Broken Authentication / Sensitive Data Exposure
CVSS v3.1 Score	7.5 (HIGH / Hermes Score 91)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fixed Versions	12.0.0.1420 P20230319, 11.0.0.837 P20230321	Official Vendor Hotfix Releases
MITRE ATT&CK	T1552.001 - Credentials in Files, T1078 - Valid Accounts	Credential Access / Privilege Escalation
Forensic Cross-Reference	Veeam Backup Vulnerability Matrix	Forensic DFIR triage for backup server intrusions

---

2. In-Depth Technical Decomposition & Root Cause

The Veeam Backup Service (Veeam.Backup.Service.exe) listens on TCP port 9401 by default. It exposes an internal communications endpoint designed to allow auxiliary backup components to retrieve configuration records.

However, the endpoint lacked authentication enforcement:

• A remote network client can connect directly to TCP port 9401.
• By sending structured .NET remoting / XML payloads, an attacker queries the Credentials table within the Veeam backend Microsoft SQL Server database.
• The service returns database connection strings, DPAPI-protected secrets, and stored credentials (including VMware vCenter root passwords and Active Directory backup operator passwords).

---

3. Attack Scenarios & Threat Modeling

1. Perimeter Breach: Attacker achieves initial network access (e.g. via PaperCut CVE-2026-81578 & CVE-2026-82078).
2. Internal Reconnaissance: Attacker scans internal subnets for listening port 9401/TCP.
3. Exploitation (CVE-2023-27532): Attacker dispatches an unauthenticated query to Veeam.Backup.Service.exe to dump the configuration database.
4. Credential Extraction: The attacker recovers domain and hypervisor credentials using tools like SharpVeeamDecryptor or VeeamDumper.
5. Ransomware Deployment: With administrative control over backups, the attacker destroys immutable repositories before initiating network-wide encryption.

---

4. Forensic Detection & Telemetry

Veeam Log Audit

Inspect C:\ProgramData\Veeam\Backup\Veeam.Backup.Service.log for unexpected connection origins on port 9401: Connecting to remote service on port 9401 from [suspicious_ip].

Process Telemetry

Monitor for processes querying the Veeam SQL database or executing VeeamDumper.exe or SharpVeeamDecryptor.exe.

---

5. Remediation Guidelines

1. Apply Hotfix KB4424: Upgrade Veeam Backup & Replication to supported versions with KB4424 applied.
2. Network Segmentation: Place backup infrastructure in dedicated, isolated VLANs. Disallow traffic to TCP port 9401 from general user and server networks.
3. Forensic Guidance: For deep investigation workflows, consult the Veeam Backup Vulnerability Matrix.