Skip to content
Sign in

Veeam product

Backup and Replication

Alert
No Backup and Replication CVE is in the CISA KEV catalogue.

Tracked since 13 Mar · latest article 28 Oct · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 0 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

1Articles · 7 days

usual rate

Exploited, by due date

No Backup and Replication CVE is in the CISA KEV catalogue.

Patch cadence and exploit odds

How often CISA adds Backup and Replication CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

CISA has not added a Backup and Replication CVE to KEV.

Fix listed

13 of 15 CVEs in coverage

2 CVEs have no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2025-64393: 92.4th percentileCVE-2026-44963: 83.6th percentileCVE-2026-21669: 67.9th percentileCVE-2026-21667: 66.7th percentileCVE-2026-21666: 66.6th percentileCVE-2026-21708: 66.4th percentileCVE-2026-21668: 44.6th percentileCVE-2026-32997: 43.6th percentileCVE-2026-21670: 34.9th percentileCVE-2026-93026: 22.4th percentileCVE-2026-21672: 13.9th percentileCVE-2026-32996: 5.9th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2025-6439392.4
CVE-2026-4496383.6
CVE-2026-2166967.9
CVE-2026-2166766.7
CVE-2026-2166666.6
CVE-2026-2170866.4
CVE-2026-2166844.6
CVE-2026-3299743.6
CVE-2026-2167034.9
CVE-2026-9302622.4
CVE-2026-2167213.9
CVE-2026-329965.9

Coverage10 articles · all time

The latest 10 articles naming Backup and Replication, in the shared story grammar.

Full timeline
Developinglatest 2 hours ago10 articles4 outlets

10 articles from 4 outlets since 13 Mar. Picked up again today after 3 weeks quiet.

Now13 Mar26 May81524291620 Sep310First reportThe Hacker News · 13 Mar, 05:57Exploited CVESecurityOnline · 10 Jun
  • Fri 13 Mar, 05:57 UTC. The Hacker News, first report. Veeam Patches 7 Critical Backup & Replication Flaws Allowing Remote Code Execution.
  • Fri 13 Mar, 14:38 UTC. SOCRadar, its first report on the story. Veeam Backup & Replication: CVE-2026-21666 and Related RCE Fixes.
  • Thu 28 May, 03:09 UTC. SecurityOnline, its first report on the story. Veeam fixes critical RCE flaw CVE-2026-32998 in backup tools.
  • Tue 9 Jun, 17:30 UTC. Security Affairs, its first report on the story. Veeam patches critical RCE in Backup & Replication 12.x.
  • Wed 10 Jun, 02:40 UTC. SecurityOnline. Check Point VPN exploited; Veeam bug lets attackers run code. Cites a CVE in CISA KEV.
  • Mon 13 Jul, 10:51 UTC. SecurityOnline. Critical CVE-2026-44963 Flaw Lets Attackers Run Arbitrary Code.
  • Tue 22 Sep, 08:23 UTC. SecurityOnline. Veeam Windows Agent Flaw Exploited to Gain SYSTEM Access.
  • Tue 22 Sep, 11:47 UTC. Security Affairs. Public Exploit Lets Local Users Gain SYSTEM Access on Veeam Agent.
  • Tue 6 Oct, 21:36 UTC. SecurityOnline. Veeam fixes critical flaw letting Backup Viewers run code on servers.
  • Wed 28 Oct, 01:02 UTC. SecurityOnline. Veeam fixes five flaws in backup and monitoring software.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 10 articles as a list
  1. Fri 13 MarDay 02
    1. Veeam Patches 7 Critical Backup & Replication Flaws Allowing Remote Code Execution05:57 · The Hacker News · First report
    2. Veeam Backup & Replication: CVE-2026-21666 and Related RCE Fixes14:38 · SOCRadar

  2. Quiet for 11 weeks

    Thu 28 MayDay 761
    1. Veeam fixes critical RCE flaw CVE-2026-32998 in backup tools03:09 · SecurityOnline · Picked up again

  3. Quiet for 13 days

    Tue 9 JunDay 881
    1. Veeam patches critical RCE in Backup & Replication 12.x17:30 · Security Affairs · Picked up again
  4. Wed 10 JunDay 891
    1. Check Point VPN exploited; Veeam bug lets attackers run code02:40 · SecurityOnline · Exploited CVE · Known exploited CVE

  5. Quiet for 5 weeks

    Mon 13 JulDay 1221
    1. Critical CVE-2026-44963 Flaw Lets Attackers Run Arbitrary Code10:51 · SecurityOnline · Picked up again

  6. Quiet for 10 weeks

    Tue 22 SepDay 1932
    1. Veeam Windows Agent Flaw Exploited to Gain SYSTEM Access08:23 · SecurityOnline · Picked up again
    2. Public Exploit Lets Local Users Gain SYSTEM Access on Veeam Agent11:47 · Security Affairs

  7. Quiet for 2 weeks

    Tue 6 OctDay 2071
    1. Veeam fixes critical flaw letting Backup Viewers run code on servers21:36 · SecurityOnline · Picked up again

  8. Quiet for 3 weeks

    Wed 28 OctDay 2291
    1. Veeam fixes five flaws in backup and monitoring software01:02 · SecurityOnline · Picked up again

All CVEs in coverage15

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2025-64393

    Veeam Backup and Replication vulnerability

    9.4Critical5.2% EPSS · 1 article
  • CVE-2026-44963

    Veeam Backup and Replication vulnerability

    9.4Critical2.4% EPSS · 3 articles
  • CVE-2026-21669

    Veeam Backup and Replication vulnerability

    Not scored1.2% EPSS · 2 articles
  • CVE-2026-21667

    Veeam Backup and Replication vulnerability

    Not scored1.1% EPSS · 2 articles
  • CVE-2026-21666

    Veeam Backup and Replication vulnerability

    Not scored1.1% EPSS · 2 articles
  • CVE-2026-21708

    Veeam Backup and Replication vulnerability

    Not scored1.1% EPSS · 1 article
  • CVE-2026-21668

    Veeam Backup and Replication vulnerability

    Not scored0.5% EPSS · 2 articles
  • CVE-2026-32997

    Veeam Backup and Replication vulnerability

    8.6High0.5% EPSS · 1 article
  • CVE-2026-21670

    Veeam Backup and Replication vulnerability

    Not scored0.4% EPSS · 1 article
  • CVE-2026-93026

    Veeam Backup and Replication vulnerability

    6.1Medium0.3% EPSS · 1 article
  • CVE-2026-21672

    Veeam Backup and Replication vulnerability

    Not scored0.2% EPSS · 1 article
  • CVE-2026-32996

    Veeam Backup and Replication vulnerability

    7.3High0.2% EPSS · 3 articles
Show 3 more CVEs
  • CVE-2026-108141

    Veeam Backup and Replication vulnerability

    5.9Medium1 article
  • CVE-2026-108140

    Veeam Backup and Replication vulnerability

    5.9Medium1 article
  • CVE-2026-108142

    Veeam Backup and Replication vulnerability

    9.1Critical1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in