CVE-2022-26503

Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to run arbitrary code with local system privileges.

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.69% chance of exploitation in the next 30 days, 52nd percentile

Published

2022-03-17

Updated

2024-08-03

Proof-of-concept exploits (1)

• sinsinology/CVE-2022-2650310★ · 2022-03-16

Security advisories

• https://veeam.com
• https://www.veeam.com/kb4289

References

• CVE Record
• NVD entry

Related

• CVE-2023-20887
• CVE-2023-34039
• CVE-2024-29847
• CVE-2024-29849
• CVE-2024-29855
• CVE-2024-4358