Documented CVEs
14 vulnerabilities cataloged in the Hermes intelligence repository.
Veeam Backup & Replication — Security Intelligence & Vulnerability Profile
1. Software Identity & Security Posture
Section titled “1. Software Identity & Security Posture”| Parameter | Technical Specification |
|---|---|
| Official Name | Veeam Backup & Replication |
| Vendor / Project | veeam |
| Canonical ID | veeam:backup_and_replication |
| Versioning Scheme | semver |
| CPE Identifiers | cpe:2.3:a:veeam:backup_and_replication:*:*:*:*:*:*:*:* |
| Overall Posture | CRITICAL |
| Recommended Safe Release | 13.0.2 |
CISA KEV Entries
2 flaws with confirmed active in-the-wild exploitation.
Weaponized Exploits
11 vulnerabilities with publicly available PoCs or weaponized exploit tooling.
Remediation Target
Recommended upgrade to 13.0.2 to neutralize known flaws.
2. 30-Day Risk Trajectory & Trend Evolution
Section titled “2. 30-Day Risk Trajectory & Trend Evolution”Progression of Hermes Threat Score (HTS) posture and maximum EPSS probability over the last 30 days:
Current HTS Score
0 / 100
= Stable over 30d
Max EPSS (Exploitation)
90.4 %
= Stable over 30d
CISA KEV Activity
2
Active in-the-wild exploitation
HTS Trend Curve (D-30 → Today)2026-08-12 → 2026-09-10
3. Vulnerability History & Version Applicability Matrix
Section titled “3. Vulnerability History & Version Applicability Matrix”| CVE | CVSS Score | EPSS Probability | CISA KEV | Affected Versions | Fixed In | Hermes Analysis |
|---|---|---|---|---|---|---|
| CVE-2026-21669 | 9.8 (CRITICAL) | 1.2% | No | v12.0.0 to v12.3.0.211 | 12.3.1.88 | Analysis → |
| CVE-2026-44963 | 9.8 (CRITICAL) | 2.4% | No | v12.0.0 to v12.3.0.211 | 12.3.1.45 | Analysis → |
| CVE-2024-40711 | 9.8 (CRITICAL) | 90.4% | CISA KEV | ≤ v12.1.2.172 | 12.2.0.334 | Analysis → |
| CVE-2025-59468 | 9 (CRITICAL) | 1.2% | No | v13.0.0 to v13.0.1.180 | 13.0.1.1071 | Analysis → |
| CVE-2025-59470 | 9 (CRITICAL) | 1.6% | No | v13.0.0 to v13.0.1.180 | 13.0.1.1071 | Analysis → |
| CVE-2026-21670 | 8.8 (HIGH) | 0.4% | No | v12.0.0 to v12.3.0.211 | 12.3.1.88 | Analysis → |
| CVE-2026-21672 | 8.8 (HIGH) | 0.2% | No | v12.0.0 to v12.3.0.211 | 12.3.1.88 | Analysis → |
| CVE-2026-21708 | 8.8 (HIGH) | 1.1% | No | v12.0.0 to v12.3.0.211 | 12.3.1.88 | Analysis → |
| CVE-2026-32997 | 8.6 (HIGH) | 0.5% | No | v13.0.0 to v13.0.1.2067 | 13.0.2 | Analysis → |
| CVE-2026-21671 | 7.5 (HIGH) | 1.3% | No | v12.0.0 to v12.3.0.211 | 12.3.1.88 | Analysis → |
| CVE-2023-27532 | 7.5 (HIGH) | 77.6% | CISA KEV | v11.0.0 to v12.0.0.1420 | 12.0.0.1420 P20230319 | Analysis → |
| CVE-2025-55125 | 7.2 (HIGH) | 0.9% | No | v13.0.0 to v13.0.1.180 | 13.0.1.1071 | Analysis → |
| CVE-2025-59469 | 7.2 (HIGH) | 0.6% | No | v13.0.0 to v13.0.1.180 | 13.0.1.1071 | Analysis → |
| CVE-2026-58070 | 6.8 (MEDIUM) | 0.1% | No | v12.0.0.0 to v13.0.1.2067 | 13.0.2 | Analysis → |
4. Ransomware & Threat Actor Exposure
Section titled “4. Ransomware & Threat Actor Exposure”Vulnerabilities impacting Veeam Backup & Replication are actively leveraged in real-world intrusion campaigns:
- CVE-2024-40711: https://www.veeam.com/kb4649 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40711 (Read deep dive analysis)
- CVE-2023-27532: https://www.veeam.com/kb4424; https://nvd.nist.gov/vuln/detail/CVE-2023-27532 (Read deep dive analysis)
5. Evaluate Running Versions in Interactive Workbench
Section titled “5. Evaluate Running Versions in Interactive Workbench”Are you operating Veeam Backup & Replication in your infrastructure? Inspect your running build to evaluate applicability, confidence score, and security deltas:
Launch Software Intelligence Workbench for Veeam Backup & Replication Run deterministic in-browser evaluation, calculate HTS threat reduction, and plan your upgrade path.