CVE-2026-98432 Impact Statement

Veeam Software Appliance and Veeam Infrastructure Appliance

Since November 2, 2026, an update that contains the fix for CVE-2026-98432 has been available in the Veeam repository for Veeam Software Appliance and Veeam Infrastructure Appliance 13.1 (kernel 5.14.0-570.60.1+27.2.el9_6_ciq).

Veeam Updater checks the repository every 12 hours. With the default update configuration, mandatory updates are installed automatically on the nearest Sunday at 14:00, based on the time zone of the backup server. If the update does not appear on the Updates tab, it may already be installed. To confirm, check the History tab in the Veeam Host Management console. For details, see Veeam Backup & Replication User Guide: Viewing Update History.

Appliances that use a local mirror of the Veeam repository receive the update after the mirror is synchronized.

To install the update without waiting for automatic installation, perform the following steps:

1. Log in to the Veeam Host Management console on the backup server.
2. In the management pane, click Updates > Check for updates.
3. On the Updates tab, select the available updates, then click Install Updates Now and confirm the operation.
4. If a backup infrastructure component uses a custom update configuration, repeat these steps in the Veeam Host Management console of that component.

A restart of the appliance may be required to complete the installation.

For more information, see Veeam Backup & Replication User Guide: Configuring Updates and Installing Updates.

Workers Deployed by Veeam Plug-Ins for Hypervisors

For Veeam Plug-Ins for hypervisors included with Veeam Backup & Replication 13.1, workers receive the updated kernel the next time they are launched. As described in the Veeam Backup & Replication User Guide:

When launching a worker for a backup or restore operation, Veeam Backup & Replication automatically downloads updates from Veeam repositories and installs them on the worker.

Linux-Based Helper Appliances

Veeam Backup & Replication deploys Linux-based helper appliances for the following operations. These appliances include their own Linux kernel. The updated appliance is delivered through Veeam Updater on Veeam Software Appliance and through the private fix on Windows-based Veeam Backup & Replication.

• Guest OS file restore from non-Windows machines, when the helper appliance is used as the mount server
• Virtual labs (proxy appliance)
• Restore of Linux workloads to Microsoft Azure
• Restore to Amazon EC2 and restore to Google Compute Engine, when the helper appliance is used

Helper appliances that are deployed for the duration of an operation use the updated appliance the next time they are deployed. The following appliances remain deployed and must be redeployed:

• Virtual labs. As described in Veeam Backup & Replication User Guide: After Upgrade:

  If you use the Virtual Labs functionality, open settings of each Virtual Lab, and click through the wizard to redeploy each virtual lab with the new proxy appliance version.

• Helper appliances in Microsoft Azure. As described in the Veeam Backup & Replication User Guide:

  To redeploy appliances, you must remove all configured appliances and then configure them once again.

  For the steps, see Removing Helper Appliances and Configuring Helper Appliances.

Veeam Recovery Media for Veeam Agent for Linux

• For Veeam Agent for Linux 13.1, the updated recovery media is delivered through Veeam Updater and available for download from this Veeam webpage.
• For the Veeam Agent for Linux version included with Veeam Backup & Replication 12.3, the updated recovery media is delivered through the private fix.

Recovery media created before the update must be replaced with recovery media created after the update is installed. For instructions, see Veeam Agent for Linux User Guide: Downloading Generic Recovery Media.

Public Cloud Appliances

The Veeam Plug-In for AWS, Veeam Plug-In for Google Cloud, and Veeam Plug-In for Microsoft Azure appliances run Ubuntu Linux and receive Ubuntu kernel updates through Veeam Updater, together with the product updates. The Ubuntu CVE tracker page lists the status of the fix for each kernel package.

Veeam Kasten for Kubernetes

The container images of Veeam Kasten for Kubernetes do not include a Linux kernel. Veeam Kasten for Kubernetes runs on the kernel of the Kubernetes node, and the node operating system is managed by the customer or the Kubernetes platform provider.

Linux Servers Managed by the Customer

Veeam does not manage the operating system on customer-deployed Linux servers that host Veeam components, such as proxies, repositories, and gateway servers. Customers managing Linux servers hosting Veeam components are advised to review the advisory from the distribution vendor:

• Ubuntu: CVE-2026-98432
• Red Hat: CVE-2026-98432

• CVE-2026-98432 | NVD