Veeam Support Knowledge Base

CVE-2026-98432 Impact Statement

2026-11-06T00:00:00Z

CVE-2026-98432 Impact Statement

KB ID:	4966
Product:	Veeam Backup & Replication Veeam Software Appliance Veeam Agent for Linux Veeam Plug-In for AWS Veeam Plug-In for Microsoft Azure Veeam Plug-In for Google Cloud Veeam Cloud Connect Veeam Kasten for Kubernetes
Published:	2026-11-06
Last Modified:	2026-11-06

Article Updates

Veeam is monitoring this vulnerability and will update this article as new information becomes available.

Summary

CVE-2026-98432 is a use-after-free vulnerability in Linux kernel TCP/IPv4 connection setup (CVSS 9.8). It can lead to denial of service or memory corruption.

Veeam components that include a Linux kernel are affected. Depending on the component, the patched kernel is delivered through Veeam Updater or a private fix. The following table lists the delivery for each product.

Product	Affected	Action
Veeam Software Appliance 13.1	Yes, until the kernel is updated	Install the update through Veeam Updater
Veeam Infrastructure Appliance 13.1, with any of the following roles: Veeam Backup & Replication General-purpose backup proxy VMware backup proxy CDP proxy Cache repository Backup repository (Linux server) Hardened repository NFS share Scale-out backup repository extent Guest interaction proxy Gateway server Mount server WAN accelerator Log shipping server Veeam Cloud Connect Cloud gateway WAN accelerator	Yes, until the kernel is updated	Install the update through Veeam Updater
Workers deployed by Veeam Plug-Ins for hypervisors	Yes, until the kernel is updated	Install the update through Veeam Updater
Veeam Backup & Replication 13.1 on Windows (Linux-based helper appliances)	Yes, until the private fix is installed	Install the private fix
Veeam Backup & Replication 12.3 (Linux-based helper appliances)	Yes, until the private fix is installed	Private fix will be made available soon
Veeam Recovery Media for Veeam Agent for Linux 13.1	Yes, for media created before the update	Install the update through Veeam Updater or download from this Veeam webpage.
Veeam Recovery Media for the Veeam Agent for Linux version included with Veeam Backup & Replication 12.3	Yes, for media created before the update	Private fix will be made available soon
Veeam Plug-In for AWS, Veeam Plug-In for Google Cloud, and Veeam Plug-In for Microsoft Azure appliances	Yes, until the kernel is updated	Install all available updates through Veeam Updater
Veeam Kasten for Kubernetes	No. The container images do not include a Linux kernel.	Follow the advisory from the node operating system or Kubernetes platform vendor
Linux servers managed by the customer	Not a Veeam component	Follow the advisory from the distribution vendor

Swipe to show more of the table

Solution

Veeam Software Appliance and Veeam Infrastructure Appliance

Since November 2, 2026, an update that contains the fix for CVE-2026-98432 has been available in the Veeam repository for Veeam Software Appliance and Veeam Infrastructure Appliance 13.1 (kernel 5.14.0-570.60.1+27.2.el9_6_ciq).

Veeam Updater checks the repository every 12 hours. With the default update configuration, mandatory updates are installed automatically on the nearest Sunday at 14:00, based on the time zone of the backup server. If the update does not appear on the Updates tab, it may already be installed. To confirm, check the History tab in the Veeam Host Management console. For details, see Veeam Backup & Replication User Guide: Viewing Update History.

Appliances that use a local mirror of the Veeam repository receive the update after the mirror is synchronized.

To install the update without waiting for automatic installation, perform the following steps:

Log in to the Veeam Host Management console on the backup server.
In the management pane, click Updates > Check for updates.
On the Updates tab, select the available updates, then click Install Updates Now and confirm the operation.
If a backup infrastructure component uses a custom update configuration, repeat these steps in the Veeam Host Management console of that component.

A restart of the appliance may be required to complete the installation.

For more information, see Veeam Backup & Replication User Guide: Configuring Updates and Installing Updates.

Workers Deployed by Veeam Plug-Ins for Hypervisors

For Veeam Plug-Ins for hypervisors included with Veeam Backup & Replication 13.1, workers receive the updated kernel the next time they are launched. As described in the Veeam Backup & Replication User Guide:

When launching a worker for a backup or restore operation, Veeam Backup & Replication automatically downloads updates from Veeam repositories and installs them on the worker.

Linux-Based Helper Appliances

Veeam Backup & Replication deploys Linux-based helper appliances for the following operations. These appliances include their own Linux kernel. The updated appliance is delivered through Veeam Updater on Veeam Software Appliance and through the private fix on Windows-based Veeam Backup & Replication.

Guest OS file restore from non-Windows machines, when the helper appliance is used as the mount server
Virtual labs (proxy appliance)
Restore of Linux workloads to Microsoft Azure
Restore to Amazon EC2 and restore to Google Compute Engine, when the helper appliance is used

Helper appliances that are deployed for the duration of an operation use the updated appliance the next time they are deployed. The following appliances remain deployed and must be redeployed:

Virtual labs. As described in Veeam Backup & Replication User Guide: After Upgrade:
If you use the Virtual Labs functionality, open settings of each Virtual Lab, and click through the wizard to redeploy each virtual lab with the new proxy appliance version.
Helper appliances in Microsoft Azure. As described in the Veeam Backup & Replication User Guide:
To redeploy appliances, you must remove all configured appliances and then configure them once again.
For the steps, see Removing Helper Appliances and Configuring Helper Appliances.

Veeam Recovery Media for Veeam Agent for Linux

For Veeam Agent for Linux 13.1, the updated recovery media is delivered through Veeam Updater and available for download from this Veeam webpage.
For the Veeam Agent for Linux version included with Veeam Backup & Replication 12.3, the updated recovery media is delivered through the private fix.

Recovery media created before the update must be replaced with recovery media created after the update is installed. For instructions, see Veeam Agent for Linux User Guide: Downloading Generic Recovery Media.

Public Cloud Appliances

The Veeam Plug-In for AWS, Veeam Plug-In for Google Cloud, and Veeam Plug-In for Microsoft Azure appliances run Ubuntu Linux and receive Ubuntu kernel updates through Veeam Updater, together with the product updates. The Ubuntu CVE tracker page lists the status of the fix for each kernel package.

Veeam Kasten for Kubernetes

The container images of Veeam Kasten for Kubernetes do not include a Linux kernel. Veeam Kasten for Kubernetes runs on the kernel of the Kubernetes node, and the node operating system is managed by the customer or the Kubernetes platform provider.

Linux Servers Managed by the Customer

Veeam does not manage the operating system on customer-deployed Linux servers that host Veeam components, such as proxies, repositories, and gateway servers. Customers managing Linux servers hosting Veeam components are advised to review the advisory from the distribution vendor:

Private Fixes

Veeam Backup & Replication 13.1

Before installing the private fix, ensure that Windows-based Veeam Backup & Replication 13.1.2.57 is installed. To check the version, open the Main Menu (≡) in the Veeam Backup & Replication Console and select Help > About.

New installations use the repacked Veeam Backup & Replication 13.1.2 ISO, which includes the fix. Installation files are downloaded from My Account.

Download 13.1.2 Private Fix

^{Filename: VeeamBackup&Replication_13.1.2.57_20261105_PrivateFix.exe}

SHA256: 63772D1ED2E9759E028F4D9693321E952B7D6D1FED4BAFC1C3C76D4DF2D0BE2B

Veeam Backup & Replication 12.3

The private fix will be made available soon.

More Information

CVE-2026-98432 | NVD

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

List of Security Fixes and Improvements in Veeam Kasten for Kubernetes

2026-11-05T00:00:00Z

List of Security Fixes and Improvements in Veeam Kasten for Kubernetes

KB ID:	4825
Product:	Veeam Kasten for Kubernetes \| 7 \| 7.5 \| 8 \| 8.5 \| 9 Kasten K10 by Veeam \| 3 \| 5 \| 5.5 \| 6 \| 6.5
Published:	2026-03-02
Last Modified:	2026-11-05

Purpose

This article describes all security-related fixes and improvements introduced in each release or update of Veeam Kasten for Kubernetes.

This article aims to provide our customers' security and compliance teams with detailed information on security improvements.

Full product release notes are available here:

Veeam Kasten for Kubernetes — Release Notes

Security Fixes and Improvements

**Veeam Kasten for Kubernetes 9.0.10**

Upgraded to the latest UBI base image to resolve multiple CVEs in base OS packages:
- ca-certificates: CVE-2026-114406 (Critical)
- expat: CVE-2026-77214 (High)
Updated github.com/go-jose/go-jose/v4 to resolve CVE-2026-116587 (High).
Updated the frontend's bundled JavaScript dependencies to resolve CVE-2023-54404 in zod (High), CVE-2026-111755, CVE-2026-111756 and CVE-2026-116689 in follow-redirects (High), CVE-2026-112942 in vite (High) and GHSA-mrv2-3pqr-j5jr in dompurify (High).
Also resolves 13 Medium and 7 Low severity CVEs in the same and other packages.

**Veeam Kasten for Kubernetes 9.0.9**

Upgraded the frontend's bundled JavaScript dependencies to resolve GHSA-g2v6-rqmx-r4w6 in @vue/server-renderer (High).
Upgraded to Go 1.27.3 to resolve CVE-2026-111943 in the Go standard library.
_{For more information review: KB4954: Mitigating Impact of Compromised eMudhra Intermediate CA Certificates on Veeam Kasten for Kubernetes.}
Also resolves 7 Medium severity CVEs in the same and other packages.

**Veeam Kasten for Kubernetes 9.0.8**

Upgraded the base image from UBI 9.8 to UBI 10.2 to resolve multiple CVEs in base OS packages:
- nginx, nginx-core and nginx-filesystem: CVE-2026-42945 (Critical); CVE-2026-27651, CVE-2026-27654, CVE-2026-27784, CVE-2026-32647, CVE-2026-42055, CVE-2026-42533, CVE-2026-60005, CVE-2026-9256 (High)
- openssl and openssl-libs: CVE-2026-84782 (High)
- pcre2 and pcre2-syntax: CVE-2026-103111, CVE-2026-86145, CVE-2026-89161 (High)
Upgraded to Go 1.27.2 to resolve CVEs in the Go standard library:
- CVE-2026-56857, CVE-2026-78663 (Critical)
- CVE-2026-56866, CVE-2026-78659, CVE-2026-78660, CVE-2026-78667, CVE-2026-78669, CVE-2026-94439, CVE-2026-94440, CVE-2026-94444, CVE-2026-94447, CVE-2026-97031, CVE-2026-97032 (High)
Updated golang.org/x/net to resolve CVE-2026-78663 (Critical) and CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032 (High).
Updated the frontend's bundled JavaScript dependencies to resolve CVE-2026-101898, CVE-2026-101901, CVE-2026-101903, CVE-2026-101905, CVE-2026-101906, CVE-2026-101907, CVE-2026-101909 in axios (High) and CVE-2026-93749 in source-map-js (High).
Also resolves 23 Medium and 2 Low severity CVEs in the same and other packages.

**Veeam Kasten for Kubernetes 9.0.7**

Upgraded to the latest UBI base image to resolve multiple CVEs in base OS packages:
- curl-minimal and libcurl-minimal: CVE-2026-8458, CVE-2026-8927 (High)
- expat: CVE-2026-66046, CVE-2026-93990 (High)
- libxml2: CVE-2026-74860, CVE-2026-86140 (High)
Updated the frontend's bundled JavaScript dependencies to resolve CVE-2026-85061 in maplibre-gl (Critical), CVE-2026-40345 in deepmerge-ts (High) and GHSA-36jr-mh4h-2g58 in d3-color (High).
Also resolves 8 Medium severity CVEs in the same and other packages.

**Veeam Kasten for Kubernetes 9.0.6**

Upgraded to the latest UBI base image to resolve multiple CVEs in base OS packages:
- libevent: CVE-2026-63382, CVE-2026-63383, CVE-2026-63384, CVE-2026-63385, CVE-2026-63387, CVE-2026-63388 (High)
- openssh, openssh-clients and openssh-server: CVE-2026-59999 (High)
- openssl and openssl-libs: CVE-2026-14456 (High)
- rsync: CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53790, CVE-2026-53791, CVE-2026-53793, CVE-2026-53795, CVE-2026-53802, CVE-2026-53803, CVE-2026-70452, CVE-2026-70456, CVE-2026-70458, CVE-2026-70460, CVE-2026-70461, CVE-2026-70463, CVE-2026-70464 (High)
Also resolves 16 Medium and 6 Low severity CVEs in the same and other packages.

**Veeam Kasten for Kubernetes 9.0.5**

Upgraded to latest UBI base image to resolve multiple CVEs in base OS packages.
Updated the Go runtime to resolve additional upstream Go CVEs.
Updated the bundled Prometheus Helm chart to resolve security issues.

**Veeam Kasten for Kubernetes 9.0.4**

Upgraded to latest UBI base image to resolve multiple CVEs in base OS packages.
Patched go-ntlmssp in the Dex component to resolve CVE-2026-32952.
Updated the Go runtime and golang.org/x/mod dependency to resolve CVE-2026-56865 and additional upstream Go CVEs.

**Veeam Kasten for Kubernetes 9.0.3**

Upgraded go-git to resolve CVE-2026-71556
Upgraded the configmap-reload sidecar to resolve CVE-2026-56852
Upgraded the Prometheus base image to resolve GHSA-hrxh-6v49-42gf - GitHub Advisory
Upgraded Dex image dependencies to resolve multiple Critical and High CVEs

**Veeam Kasten for Kubernetes 9.0.2**

Upgraded to the latest UBI base image to resolve multiple CVEs.
Updated third-party dependencies (gomplate, logger base image) in the dex and logger components to address known vulnerabilities.

**Veeam Kasten for Kubernetes 9.0.1**

Upgraded to Go 1.26.5 to resolve CVE-2026-39822 & CVE-2026-42505
Updated the UBI minimal base image to incorporate the latest security fixes.
Improved logging security for Veeam Backup & Replication API credentials and other sensitive values previously written to Kasten logs.
- It is recommended to upgrade Veeam Kasten and to refresh the token by manually logging out.
Upgraded components of Kasten's bundled Prometheus monitoring stack to resolve multiple CVEs

**Veeam Kasten for Kubernetes 8.5.13**

Updated base images used in the Red Hat Marketplace operator bundle to fix multiple Critical and High CVEs

**Veeam Kasten for Kubernetes 8.5.12**

Upgraded to the latest UBI base image to resolve CVE-2026-45186 and CVE-2026-45447
Upgraded to Go 1.26.4 to resolve CVE-2026-42504
Kasten Multi-cluster Permissions: Hardened multi-cluster security by tightening the permissions granted to the impersonation `ClusterRole` on managed secondary clusters and removing sensitive token values from debug logs.

**Veeam Kasten for Kubernetes 8.5.10**

Upgraded to latest UBI base image to resolve CVE-2026-40356 and CVE-2026-4878
Immutability regression in Kasten 8.5.1–8.5.9 (S3 / GCS / Azure)
Newly written backup objects were not stamped with a retain-until date at write time and remained deletable until the Blob Lifecycle Manager applied protection on its next refresh cycle. A user, script, or attacker with bucket delete permissions could permanently delete those objects during this window, potentially rendering the affected restore points unrecoverable.

Mitigation: Configure a bucket-level Default Object Lock retention so the object store stamps new objects at write time, or upgrade to Kasten 8.5.10.

**Veeam Kasten for Kubernetes 8.5.5**

Upgrade to Go 1.26.1 to address CVE-2026-25679 and CVE-2026-27142
Updated the UBI base image to address CVE-2026-4111

**Veeam Kasten for Kubernetes 8.5.3**

Upgrade to Go 1.25.7 to address CVE-2025-61732.

**Veeam Kasten for Kubernetes 8.5.2**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.5.1**

Upgrade to Go 1.25.6 to address CVEs:
Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.15**

Upgrade to Go 1.25.5 to address CVE-2025-61727 and CVE-2025-61729.
Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.14**

Improved logging security for specific block mode datamover upload Pod invocations. It is recommended to upgrade Veeam Kasten to get this fix.

**Veeam Kasten for Kubernetes 8.0.13**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.11**

Upgrade to Go 1.25.3 to mitigate security vulnerabilities.
Upgrade to golang.org/x/net@v0.46.0 to address CVE-2025-58190 and CVE-2025-47911.
Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.10**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.8**

Upgrade to Go 1.24.7 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 8.0.7**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.6**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.
Upgrade to Go 1.24.6 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 8.0.5**

Increased the security of the generated backup repository passwords.
Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.4**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.
Upgrade to Go 1.24.5 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 8.0.3**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 8.0.2**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.
Upgrade to Go 1.24.4 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 8.0.1**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.
Upgrade to Go 1.24.3 to mitigate CVE-2025-22873.

**Veeam Kasten for Kubernetes 8.0.0**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.5.9**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.
Upgrade to Go 1.23.8 to mitigate CVE-2025-22871.

**Veeam Kasten for Kubernetes 7.5.8**

Updated base image used to build Veeam Kasten container images to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.5.5**

Upgrade to Go 1.23.7 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 7.5.4**

Update K10 services base image to pull in latest security updates.
Updated base image used to build Veeam Kasten container images to pull in latest security updates.
Upgrade to Go 1.23.6 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 7.5.3**

Upgraded Prometheus to chart version v26.1.0 to pull in latest security updates.
Update K10 services base image to pull in latest security updates.
Redacted sensitive information in Kasten logging.

**Veeam Kasten for Kubernetes 7.5.2**

Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.5.1**

Basic users are now restricted from viewing application details of applications in other namespaces.
Basic users now require specific permission to view each action type through the Veeam Kasten dashboard.
Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.5.0**

Improved algorithm for authentication cookie validation in OIDC mode. All the users will need to re-login.

**Veeam Kasten for Kubernetes 7.0.14**

Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.13**

Update Grafana version to 8.5.8 to pull in the latest security updates.
Upgraded Prometheus chart version to 25.28.0 to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.10**

Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.9**

Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.8**

Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.6**

Fixed critical authentication vulnerability. This upgrade is recommended for all users.

**Veeam Kasten for Kubernetes 7.0.5**

Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.4**

Upgrade Fluent Bit to mitigate CVE-2024-4323.
Upgrade to Go 1.22.5 to mitigate security vulnerabilities.

**Veeam Kasten for Kubernetes 7.0.2**

Upgrade Python packages to mitigate security vulnerabilities.
Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.1**

Upgrade to Go 1.22.4 to mitigate security vulnerabilities.
Update K10 services base image to pull in latest security updates.

**Veeam Kasten for Kubernetes 7.0.0**

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.5.14

Limited the scope of infrastructure credentials to improve security posture.
Upgrade to Go 1.22.3 to mitigate security vulnerabilities.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.5.13

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.5.11

Upgraded to Go v1.21.9 to mitigate security vulnerabilities.

Kasten K10 by Veeam 6.5.9

Users are now restricted from listing actions in namespaces without proper authorization. All customers are encouraged to upgrade to get the fix for this issue.

Kasten K10 by Veeam 6.5.7

Upgraded google.golang.org/protobuf to mitigate CVE-2024-24786.
Upgraded to Go v1.21.8 to mitigate security vulnerabilities.
Changes in SecurityContextConstraints resource were made to reflect the latest securityContext updates on K10 workloads.
Explicitly set runAsNonRoot=true, seccompProfile=RuntimeDefault, allowPrivilegeEscalation=false and capabilities.drop=["ALL"] for K10 service containers.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.5.4

Explicitly set runAsNonRoot=true, seccompProfile=RuntimeDefault, allowPrivilegeEscalation=false and capabilities.drop=["ALL"] for K10 service containers.
Users are now restricted from restoring data without proper authorization. All customers are encouraged to upgrade to get the fix for this issue.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.5.3

Improve logging to prevent logging of sensitive backup location connection details.

Kasten K10 by Veeam 6.5.2

Upgrade golang.org/x/crypto to mitigate security vulnerability CVE-2023-48795.
Updates dependencies to address security vulnerabilities in 3rd party libraries.

Kasten K10 by Veeam 6.5.1

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.5.0

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.0.10

Upgrade to Go v1.21.3 to mitigate security vulnerabilities.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.0.8

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.0.7

Upgrade to Go 1.20.8 to mitigate security vulnerabilities.

Kasten K10 by Veeam 6.0.5

Upgrade golang.org/x/net to v0.13.0 to mitigate CVE-2023-3978.
Upgrade to Go 1.20.7 to mitigate security vulnerabilities.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 6.0.3

Updates emissary's Go dependencies to address security vulnerabilities.
Upgrade to Go 1.20.6 to mitigate security vulnerabilities.

Kasten K10 by Veeam 6.0.2

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.11

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.9

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.7

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.6

Upgrade to Go 1.19.6 to mitigate security vulnerabilities.

Kasten K10 by Veeam 5.5.5

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.4

Basic users are now restricted from using transforms in RestoreActions.

Kasten K10 by Veeam 5.5.3

It is now possible to prevent basic users from creating ImportActions or RestoreActions. In some multi-tenant environments, these actions should only be available to administrators.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.2

Upgrade to Go 1.19.4 to mitigate security vulnerabilities.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.1

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.5.0

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.0.11

Upgrade Dex image to mitigate security vulnerabilities.
Upgrade to Go 1.19.2 to mitigate security vulnerabilities.

Kasten K10 by Veeam 5.0.9

Update Grafana version to 9.1.5 to pull in the latest security updates.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.0.8

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 5.0.5

Update K10 services base image to pull in latest security updates.
Update Emissary Ingress to 3.1.0 to include latest security updates.

Kasten K10 by Veeam 5.0.3

Upgrade to Go 1.17.12 to include the latest security patches.

Kasten K10 by Veeam 5.0.2

Update K10 services base image to pull in latest security updates.
Update Emissary Ingress (Ambassador) to 3.0.0 to include latest security updates.

Kasten K10 by Veeam 5.0.0

Upgrade to Go 1.17.10 to include the latest security patches.

Kasten K10 by Veeam 4.5.15

Update Grafana version to 8.5.0 to pull in the latest security updates.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.5.13

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.5.12

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.5.11

Update Ambassador to 1.14.3 to include latest security updates.

Kasten K10 by Veeam 4.5.10

Upgrade to Go 1.17.7 to mitigate CVE-2022-23772 and CVE-2022-23806.

Kasten K10 by Veeam 4.5.9

Fix CVE-2021-23017 discovered in the previous nginx versions.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.5.7

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.5.6

Update Grafana version to pull in fix for CVE-2021-43798.

Kasten K10 by Veeam 4.5.2

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.13

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.10

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.9

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.6

Fix proxy requests to secondary clusters to be restricted to the secondary cluster.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.5

Update Go to pull in latest security fixes.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.4

Update Ambassador to 1.13.6 to include latest security updates.
Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 4.0.3

Upgrade golang.org/x/net prevent denial of service (CVE-2021-33194).

Kasten K10 by Veeam 4.0.2

Update K10 services base image to pull in latest security updates.

Kasten K10 by Veeam 3.0.13

Update Ambassador version to pull in security fixes in Envoy 1.15.4

Kasten K10 by Veeam 3.0.1

Mitigate potential crashes caused by malicious certificates.

Kasten K10 by Veeam 2.5.14

Module upgrades to address CVE-2020-14040.
Upgraded Ambassador to incorporate the Envoy 1.14.3 security update.

Kasten K10 by Veeam 2.5.12

When K10 is deployed with OIDC, user-initiated actions (via the API, CLI, or the dashboard) will be attributed to the user instead of the K10 service account.

Kasten K10 by Veeam 2.5.9

Upgraded several JavaScript packages to address recently disclosed CVEs.

More Information

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Veeam Software Appliance Fails to Boot with Kernel Panic on AMD EPYC Hosts

2026-11-04T00:00:00Z

Veeam Software Appliance Fails to Boot with Kernel Panic on AMD EPYC Hosts

KB ID:	4960
Product:	Veeam Backup & Replication Veeam Software Appliance
Published:	2026-11-04
Last Modified:	2026-11-04

Challenge

A Veeam Software Appliance (Linux-based Veeam Backup & Replication) virtual machine running on a host with an AMD EPYC processor intermittently fails to boot after a reboot, including a reboot that follows an update that installs a new kernel. The following kernel panic occurs during early boot:

Kernel panic - not syncing: jitterentropy: Initialization failed with host not compliant with requirements: 9

The virtual machine remains unavailable until it is restarted manually. Depending on the hypervisor, the message may be visible only through a serial console or in the hypervisor event log.

Cause

This issue occurs because the Linux kernel used by the Veeam Software Appliance runs a jitterentropy health test in FIPS mode during early boot, and the test intermittently fails on certain AMD EPYC processors, including AMD EPYC 7262, 7302, and 7F72. When the test fails, the kernel stops the boot process with a kernel panic.

This behavior originates in the Linux kernel, and a fix is currently not available for the kernel version used by the Veeam Software Appliance. The issue affects Veeam Software Appliance version 13.1 and later.

Solution

Consider redeploying the Veeam Software Appliance on a host with a different processor. For more information on deploying the appliance, see Installing Veeam Software Appliance from ISO.

If redeploying the appliance on a host with a different processor is not an option, perform the following:

Disable automatic updates for the appliance. For more information, see Configuring Updates.
Install updates manually, and monitor the virtual machine while it reboots.
If the kernel panic occurs, power off the virtual machine and power it on again. A restart of the guest operating system does not recover the virtual machine.

After the appliance has booted successfully, no further errors are expected, and the operation of Veeam Backup & Replication is not affected.

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

How to Change the Veeam Reverse Proxy Service Port (443) After Deployment

2026-11-03T00:00:00Z

How to Change the Veeam Reverse Proxy Service Port (443) After Deployment

KB ID:	4899
Product:	Veeam Backup & Replication \| 13 \| 13.1
Published:	2026-11-03
Last Modified:	2026-11-03

Purpose

This article documents how to adjust the Primary service port (default 443) on a Windows-based Veeam Backup & Replication deployment after installation, and how to update the remote consoles that connect to it.

Starting in Veeam Backup & Replication 13.1, the software consolidates client service traffic behind the Veeam Reverse Proxy Service, which listens on port 443, by default. During initial deployment of Veeam Backup & Replication, the Primary service port can be configured during the Port Configuration step.

After deployment, the Primary service port can only be adjusted using the procedure in this article.

Solution

Impact on Connected Components

Changing the primary service port affects components that connect to the Veeam Backup Server. Connections from remote Veeam Backup & Replication Consoles and PowerShell are covered in this article. Other components that connect to the Veeam Backup Server may also be affected, including the known issues described at the end of this procedure. The Veeam Backup Server must be restarted so that every Veeam service uses the new port, and each remote console machine must be updated separately. This procedure should be performed during a maintenance window to reduce the impact on data protection operations.

In the steps below, port 8443 is used as the new port for example only.

Changing the Port on the Veeam Backup Server

The following steps are performed on the Veeam Backup Server.

Open an Administrative PowerShell Terminal session on the Veeam Backup Server.
Stop the Veeam Reverse Proxy Service:

Stop-Service VeeamReverseProxySvc

Open the following file in a text editor:
C:\ProgramData\Veeam\ReverseProxy\Config\appsettings.json
Within the Service section, change the value of Port to the new port number.
After the change, the Service section will appear as follows:
```
"Service": {
  "Port": 8443,
  "TlsHandshakeTimeout": "00:00:30"
}
```
Save the file.
In Windows Firewall, create an inbound rule that allows TCP traffic on the new port. The rule created by the installer allows traffic on the original port only, and is not updated automatically. Operations that require this port, such as file-level restores through a remote mount server, fail while the port is closed. The rule can be created using the following PowerShell command:

$port = 8443
New-NetFirewallRule -DisplayName "Veeam Reverse Proxy Service (Custom Port) (In)" -Direction Inbound -Protocol TCP -LocalPort $port -Action Allow

Restart the Veeam Backup Server so that every Veeam service starts with the new port. Restarting only the Veeam Reverse Proxy Service, or only the Veeam Backup Service, is not sufficient, because all Veeam services must use the new port.

Updating Remote Consoles

Machines running a remote Veeam Backup & Replication Console, or connecting to the Veeam Backup Server with PowerShell, read the port to connect with from the ReverseProxyCustomPort registry value. If the value is not set, connections continue to be attempted on the default port 443 and will fail.

Note: The ReverseProxyCustomPort value determines only which port a client connects to. It does not change the port that the Veeam Reverse Proxy Service listens on. Setting this value without also changing the port used by the Veeam Reverse Proxy Service on the Veeam Backup Server will cause connections to fail. On the Veeam Backup Server itself, the value is ignored because the local appsettings.json file always takes precedence.

On each machine running a remote Veeam Backup & Replication Console or connecting with PowerShell, create or modify the following registry value:

Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
Value Name: ReverseProxyCustomPort
Value Type: DWORD (32-Bit) Value
Value Data: 8443

After the value has been set, restart the Veeam Backup & Replication Console.

The registry value can also be created using the following PowerShell command:

$port = 8443
New-ItemProperty -Path "HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication" -Name "ReverseProxyCustomPort" -Value $port -PropertyType DWORD -Force

Non-Elevated Consoles

A console that is started without elevation cannot read the port from either the local appsettings.json file or the ReverseProxyCustomPort value under HKEY_LOCAL_MACHINE, and continues to connect to port 443. For users who run the console without elevation, use one of the following:

Run the Veeam Backup & Replication Console as an administrator.
Specify the port explicitly when connecting, in the host:port format.
Create the ReverseProxyCustomPort value under HKEY_CURRENT_USER\SOFTWARE\Veeam\Veeam Backup and Replication\ instead of the HKEY_LOCAL_MACHINE location.

Verification

After the Veeam Backup Server has restarted, run the following command on the Veeam Backup Server to confirm that the Veeam Reverse Proxy Service is listening on the new port:

netstat -ano | findstr ":8443"
                     
                    

The change can also be confirmed in the following log:
C:\ProgramData\Veeam\ReverseProxy\Logs\service.log

After the restart, the listeners are bound to the new port:

[INF]   Now listening on: https://localhost:8443
[INF]   Now listening on: https://[::]:8443

Known Issue: Veeam Backup Enterprise Manager Loses Its Connection to the Backup Server

Issue Summary

After the port is changed, Veeam Backup Enterprise Manager continues to connect to the Veeam Backup Server on the previous port. The port cannot be updated by editing the backup server in the Enterprise Manager web UI. The failed connection is recorded in the Svc.VeeamBES.log file, as shown in the following example:

[CGrpcVbSrvServiceProxy] Connecting by certificate to VBR's [vbr.domain.tld] grpc port [443]. New remoting client id generated:
Updating licensed instances group ids
Unable to connect by gRPC to host [vbr.domain.tld]
No connection could be made because the target machine actively refused it.

Resolution

To restore the connection:

Remove the backup server from Enterprise Manager.
Add it again, specifying the new port.
_{Note: Re-adding a backup server can create duplicate entries in the Enterprise Manager database. The duplicate entries are temporary.}

This behavior will be improved in a future version to allow the port used to connect to the Veeam Backup Server to be modified.

Known Issue: Veeam Updater Connection Errors

Issue Summary

When the Primary service port has been changed, host discovery (a rescan of the Veeam Backup Server) and Update Settings Synchronization continue to connect to the Veeam Updater service on port 443. As a result, the following error occurs:

Failed to connect to the Veeam Updater service
No connection could be made because the target machine actively refused it.
(hostname:443)

While this error occurs, the Veeam Updater service may be unable to retrieve licensing information and discover available updates.

Resolution

This issue was resolved starting in Veeam Backup & Replication 13.1.2.

Known Issue: Veeam Service Provider Console Cannot Connect to the Backup Server

Issue Summary

In Veeam Service Provider Console 9.2 and older, connections to a Veeam Backup Server are always made using port 443. When the Primary service port has been changed, the following operations fail:

Adding the backup server as a Cloud Connect server or as a hosted backup server fails with the error Backup services are not responding or not running, although all Veeam services are running.
Opening a wizard that is redirected from Veeam Service Provider Console for a managed backup server fails with the error Failed to load the backup server plugin. Refresh the page and try again.
Opening the backup server web UI using Open Web UI fails with the error Target product's (Vbr) UI is inaccessible.

Resolution

This issue was resolved starting in Veeam Service Provider Console 9.3, now the configured port will be used appropriately.

More Information

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Release Information for Veeam Management Pack for Microsoft System Center 13.1

2026-10-29T00:00:00Z

Release Information for Veeam Management Pack for Microsoft System Center 13.1

KB ID:	4949
Product:	Veeam Management Pack \| 13
Published:	2026-10-29
Last Modified:	2026-10-29

Requirements

Please confirm that you are running version 9a (build 9.1.0.3107) prior to upgrading, as upgrade to version 13.1 is supported from this version only. You can check this in the Operations Manager console under Administration, Management Packs section. After upgrading, your build number will be 13.1.0.334.

Release Information

13.1.0.334

2026-10-29

Release Notes

Security

Vulnerabilities

CVE-2026-107239 | Severity: High (8.8)
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.
CVE-2026-107238 | Severity: High (8.7)
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.
CVE-2023-22793 | Severity: Critical (9.3)
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

Third-Party Component Upgrades

.NET upgraded to version 10.0.13
axios upgraded to version 1.20.0
DOMPurify upgraded to version 3.4.16
form-data upgraded to version 4.0.6
Microsoft.AspNetCore.Authentication.Negotiate upgraded to version 10.0.13
Microsoft.OpenApi upgraded to version 2.9.0
nanoid upgraded to version 6.0.1
PostCSS upgraded to version 8.5.23
source-map-js upgraded to version 1.2.2
System.Security.Cryptography.Xml upgraded to version 10.0.13

Download Information

Installation files are downloaded from the Veeam My Account portal.

For Veeam Management Pack for Microsoft System Center 13.1 use the installation package for:

New deployments of Veeam Management Pack for Microsoft System Center 13.1.
Upgrading existing deployments of Veeam Management Pack for Microsoft System Center 9a to 13.1.

DOWNLOAD FROM MY ACCOUNT

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Vulnerabilities Resolved in Veeam Management Pack for Microsoft System Center 13.1

2026-10-29T00:00:00Z

Vulnerabilities Resolved in Veeam Management Pack for Microsoft System Center 13.1

KB ID:	4961
Product:	Veeam Management Pack \| 9.0 \| 9a
Published:	2026-10-29
Last Modified:	2026-10-29

Veeam Software Security Commitment

Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits. When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information. This approach ensures that all potentially affected customers can quickly implement the necessary measures to safeguard their systems. It’s important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software. This reality underscores the critical importance of ensuring that all customers use the latest versions of our software and install all updates and patches without delay.

Issue Details

CVE-2026-107239

A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.

Severity: High
CVSS v4.0 Score: 8.8CVSS: AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L
Source: Discovered during internal testing.

Affected Product

Veeam Management Pack for Microsoft System Center 9.1 and all earlier version 9 builds, including the Veeam Backup & Replication 13 compatibility patch.
_{Note: A fix will not be provided for version 9.x. Customers running version 9.x should upgrade to 13.1.0.334.}
_{Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable.}

Solution

This vulnerability was fixed starting in the following build:

Veeam Management Pack for Microsoft System Center 13.1 (build 13.1.0.334)

CVE-2026-107238

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.

Severity: High
CVSS v4.0 Score: 8.7CVSS: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: Discovered during internal testing.

Affected Product

Veeam Management Pack for Microsoft System Center 9.1 and all earlier version 9 builds, including the Veeam Backup & Replication 13 compatibility patch.
_{Note: A fix will not be provided for version 9.x. Customers running version 9.x should upgrade to 13.1.0.334.}
_{Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable.}

Solution

This vulnerability was fixed starting in the following build:

Veeam Management Pack for Microsoft System Center 13.1 (build 13.1.0.334)

CVE-2023-22793

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

Severity: Critical
CVSS v4.0 Score: 9.3CVSS: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: Discovered during internal testing.

Affected Product

Veeam Management Pack for Microsoft System Center 9.1 and all earlier version 9 builds, including the Veeam Backup & Replication 13 compatibility patch.
_{Note: A fix will not be provided for version 9.x. Customers running version 9.x should upgrade to 13.1.0.334.}
_{Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable.}

Solution

This vulnerability was fixed starting in the following build:

Veeam Management Pack for Microsoft System Center 13.1 (build 13.1.0.334)

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Failed to connect to the worker service: "Alberta Standard Time" or "British Columbia Standard Time" was not recognized as a valid Windows time zone ID

2026-10-28T00:00:00Z

Failed to connect to the worker service: "Alberta Standard Time" or "British Columbia Standard Time" was not recognized as a valid Windows time zone ID

KB ID:	4958
Product:	Veeam Backup & Replication \| 13 \| 13.1 Veeam Backup for Nutanix AHV Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization Veeam Sangfor aSV Plug-In Veeam Plug-In for Xen Veeam Plug-In for Proxmox VE Veeam Plug-in for Scale Computing HyperCore
Published:	2026-10-28
Last Modified:	2026-10-28

Challenge

After the Windows OS time zone of the Veeam Backup Server is changed to Alberta Standard Time, new and existing workers fail with the following error:

Failed to connect to the worker service: "Alberta Standard Time" was not recognized as a valid Windows time zone ID

Alternatively, after the Windows OS time zone of the Veeam Backup Server is changed to British Columbia Standard Time, new and existing workers fail with the following error:

Failed to connect to the worker service: "British Columbia Standard Time" was not recognized as a valid Windows time zone ID

Cause

This issue occurs because the worker service does not recognize the Alberta Standard Time and British Columbia Standard Time time zone IDs when they are set as the Windows OS time zone of the Veeam Backup Server. Microsoft introduced these time zones, displayed in Windows Settings as (UTC-06:00) Mountain Time (Alberta) and (UTC-07:00) Pacific Time (British Columbia), because Alberta and British Columbia are no longer changing between standard time and daylight saving time.

All supported versions of Veeam Backup for Nutanix AHV and of the other Veeam plug-ins for third-party hypervisors are affected, because they share the same code base.

Solution

As a temporary workaround, change the Windows OS time zone of the Veeam Backup Server to the fixed-offset time zone that provides the same UTC offset for the affected area, as described in the Microsoft interim guidance. These time zones have different names, geographic mappings, and historical rules, so they should not be treated as permanent replacements.

Affected Area	Windows Time Zone to Select
Alberta	(UTC-06:00) Saskatchewan (Canada Central Standard Time)
Yellowknife and Inuvik	(UTC-06:00) Saskatchewan (Canada Central Standard Time)
Southeastern British Columbia locations that align with Alberta	(UTC-06:00) Saskatchewan (Canada Central Standard Time)
Most of British Columbia	(UTC-07:00) Yukon (Yukon Standard Time)

Swipe to show more of the table

On the Veeam Backup Server, open Settings > Time & language > Date & time.
Turn off Set time zone automatically, because Windows selects the new time zone automatically when this option is enabled.
In the Time zone list, select the time zone listed in the table above for the affected area.

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Release Information for Everpure Fusion Plug-In for Veeam Backup & Replication

2026-10-28T00:00:00Z

Release Information for Everpure Fusion Plug-In for Veeam Backup & Replication

KB ID:	4129
Product:	Veeam Backup & Replication \| 13.1
Published:	2021-03-15
Last Modified:	2026-10-29

This plug-in leverages the Veeam Universal Storage API, which enables storage OEMs to allow Veeam Backup & Replication integration to the arrays for backup and replication jobs.

Requirements

Before installing Everpure Fusion Plug-In v2.2.595, ensure that you are running Veeam Backup & Replication 13.1.0.411 or later. To check the version, open the main menu of the Veeam Backup & Replication console and select Help > About.
Note: Customers using an earlier version of Veeam Backup & Replication may use the previous plug-in version.

Everpure Fusion Plug-In v2.2.595 requires Everpure Fusion. Storage systems must be added to Veeam Backup & Replication as members of an Everpure Fusion fleet.

What's New

Added support for Veeam Software Appliance.
Added support for Everpure Fusion.
Added support for asynchronous snapshot replication for volumes that are part of a volume group.

Known Issues

Coexistence with Everpure FlashArray Plug-In for Veeam Backup & Replication

This plug-in version supports only storage arrays that are part of Everpure Fusion. For standalone storage arrays, use Everpure FlashArray Plug-In for Veeam Backup & Replication 2.2.331.
Upgrade and migration from Everpure FlashArray Plug-In for Veeam Backup & Replication are not supported. This plug-in is installed as a separate component and can coexist with previous versions of Everpure FlashArray Plug-In for Veeam Backup & Replication.
You cannot use the same storage array with both plug-ins at the same time. To move a storage array from the standalone plug-in to the Everpure Fusion plug-in, remove the array from Veeam Backup & Replication, then add it again with the Everpure Fusion plug-in and create new jobs. Retention of the new jobs does not apply to existing snapshots, so you will need to manage these snapshots manually.

Asynchronous snapshot replication

For volumes that are part of a volume group, at least one snapshot must be replicated to the target volume for it to be registered correctly.
The volume should be added to the Protection Group by explicitly selecting it in the Protection Group settings. In case you've added the volume to the Protection Group via Host/Host Group, make sure to manually trigger the transfer of at least one Protection Group snapshot before adding the target volume to Veeam Backup & Replication otherwise the replication relationship will not be detected.
For volumes with multiple different asynchronous snapshot replication relationships, the snapshot chain is only kept on one of the targets.
For volumes on the target side of an asynchronous snapshot replication relationship, the volume size is displayed in Veeam Backup & Replication as '0'.

NFS

NFS support requires Purity 6.10.1 or later.
This plug-in version provides limited support for NFS datastores with FlashArray File Services. Only backing up from storage snapshots is supported, while restoring from storage snapshots or replication functionality with FlashArray File Services are not.
NFS is supported only on arrays added to Veeam Backup & Replication as the fleet entry point. NFS support for other fleet member arrays is experimental.
If several backup jobs process VMs on the same NFS datastore at the same time, one of the jobs can fail. When one job finishes, it removes the NFS export that the other jobs still use to read their snapshots, and their VM processing fails with the “No such file or directory” error. To work around the issue, schedule such jobs so that they do not overlap.
In cases where a Managed Directory has several NFS exports, to indicate a preferred one (the one with an NFS datastore created on it), use the nfsDirectoryExportPreference setting in the storage_plugin_advanced_settings.json configuration file. The file is located in the following folder:
- For Veeam Backup & Replication on Veeam Software Appliance (see Installing and Updating Plug-Ins on Linux-Based Backup Server):
  /etc/veeam/plugins/storages//storage_plugin_advanced_settings.json
- For Veeam Backup & Replication on Windows (see Installing Plug-Ins on Microsoft Windows-Based Backup Server):
  C:\ProgramData\Veeam\Storage\\storage_plugin_advanced_settings.json
Example:

{
  "nfsDirectoryExportPreference": {
    "myFA1::FileSystem3:md1": "myexp4",
    "myFA1::myPod1::FileSystem2:md1": "myexp3"
  }
}
                     
                    

Snapshot Offload

Archived snapshots that have been destroyed but not eradicated can still be visible in Veeam Backup & Replication Console and can be used for restores until being eradicated by the storage cleanup mechanisms.
In case a backup job with the snapshot offload option enabled is not configured to keep snapshots on the primary array, the latest archived snapshot cannot be used for restore from archive. This is due to the fact that the latest snapshot is always kept on the storage as a temporary transfer snapshot, so it cannot be downloaded from the archive. As a workaround, it is recommended to configure the job to keep at least one primary storage snapshot.

Other

Source/target side selection for synchronous replication relationships occurs based on the host mapping information from the arrays.
- If a volume only on one side of the relationship is mapped to a host, that side is considered the source.
- If volumes on both sides are mapped, the 'Preferred Arrays' setting in the storage management console's host settings is used. If that setting is not configured, the first array in alphabetical order is considered the source.
Enabling Kerberos for Everpure storage requires additional configuration on both the storage and proxy sides:
1. On the storage side, create the export policy VEEAM_RO_POLICY if it does not already exist, then configure it to allow only the supported Kerberos security level (krb5, krb5i, or krb5p).
2. Add every Veeam Backup Proxy to VEEAM_RO_POLICY as a client. For each proxy, add the IPv6 address first, followed by the IPv4 address.
3. Depending on the environment, additional proxy-side configuration may be required. For details, see Kerberos Authentication (Storage Systems) in the User Guide.
If an error occurs while you edit a fleet member storage system in Veeam Backup & Replication 13.1, and you ignore the error and complete the wizard, Veeam Backup & Replication adds a duplicate entry for the same storage system to the backup infrastructure instead of updating the existing one. The error can be, for example, a failed certificate retrieval, a connection error, an unavailable plug-in service or a configuration database failure. To work around the issue, remove the duplicate entry from the Storage Infrastructure view.
When you edit a fleet member storage system in Veeam Backup & Replication 13.1, the wizard lists all storage protocols, including protocols that the plug-in does not support, for example, NVMe-oF. If you select an unsupported protocol, Veeam Backup & Replication displays a warning during storage rescan. Backup infrastructure operations are not affected.

Download Information

For Veeam Backup & Replication on Windows

Download Everpure Fusion Plug-In

^{Filename: 0216_EverpureFusionPlugin_2.2.595.zip

Updated: 2026-10-26

SHA256: B2A8E8167E0263D12CBA055224714F7324F5FCD00A28E876C9710B068801089D}

For Veeam Backup & Replication on Veeam Software Appliance

Download Plug-In for VSA

^{Filename: 0216_everpure-fusion-2.2.595.0.bndl

Updated: 2026-10-26

SHA256: 3BBFE20FCC5D238CF7FEB6BF379A59628A6EBA6BF0CE216265CEF10D5120D9B9}

Previous Versions

**Everpure FlashArray Plug-In for Veeam Backup & Replication [2.2.331]**

Requirements

Before installing Everpure FlashArray Plug-In v2.2.331, ensure that you are running Veeam Backup & Replication 12.3.0.310 or later. To check the version, open the main menu of the Veeam Backup & Replication console and select Help > About.

Pure Storage FlashArray Plug-In v2.2.331 supports integration with the following storage systems:

Purity 6.3 or later

Resolved Issues

Fixed incorrect handling of the SafeMode policy when manual eradication is disabled. Backup jobs no longer report false warnings or failures for snapshots and volume clones that have already been destroyed and are awaiting automatic eradication by the storage system.
Fixed a potential memory leak caused by background garbage collector processes in certain scenarios.

Known Issues

Source/target side selection for synchronous replication relationships occurs based on the host mapping information from the arrays.
- If a volume only on one side of the relationship is mapped to a host, that side is considered the source.
- If volumes on both sides are mapped, the 'Preferred Arrays' setting in the storage management console's host settings is used. If that setting is not configured, the first array in alphabetical order is considered the source.
Volumes that are part of a Volume Group are not supported for asynchronous snapshot replication.
For asynchronous snapshot replication, the volume should be added to the Protection Group by explicitly selecting it in the Protection Group settings. In case you've added the volume to the Protection Group via Host/Host Group, make sure to manually trigger the transfer of at least one Protection Group snapshot before adding the target volume to Veeam Backup & Replication otherwise the replication relationship will not be detected.
For volumes with multiple different asynchronous snapshot replication relationships, the snapshot chain is only kept on one of the targets.
For volumes on the target side of an asynchronous snapshot replication relationship, the volume size is displayed in Veeam Backup & Replication as '0'.
Archived snapshots that have been destroyed but not eradicated can still be visible in Veeam Backup & Replication Console and can be used for restores until being eradicated by the storage cleanup mechanisms.
In case a backup job with the snapshot offload option enabled is not configured to keep snapshots on the primary array, the latest archived snapshot cannot be used for restore from archive. This is due to the fact that the latest snapshot is always kept on the storage as a temporary transfer snapshot, so it cannot be downloaded from the archive. As a workaround, it is recommended to configure the job to keep at least one primary storage snapshot.
In cases where a Managed Directory has several NFS exports, to indicate a preferred one (the one with an NFS datastore created on it), a nfsDirectoryExportPreference.json config file can be used. The file must be located in the plug-in installation folder (C:\Program Files\Veeam\Backup and Replication\Plugins\Storage\Pure Storage FlashArray\nfsDirectoryExportPreference.json) and have a json format with the directory name as the key and the export name as the value.

Example:

{
    "myFileSystem1:md": "myexp5",
    "myFileSystem1:md2": "myexp1",
    "myPod1::FileSystem2:md1": "myexp3",
    "myFA1::FileSystem3:md1": "myexp4"
}
                     
                    

Enabling Kerberos for Everpure storage requires additional configuration on both the storage and proxy sides:
1. On the storage side, create the export policy VEEAM_RO_POLICY if it does not already exist, then configure it to allow only the supported Kerberos security level (krb5, krb5i, or krb5p).
2. Add every Veeam Backup Proxy to VEEAM_RO_POLICY as a client. For each proxy, add the IPv6 address first, followed by the IPv4 address.
3. Depending on the environment, additional proxy-side configuration may be required. For details, see Kerberos Authentication (Storage Systems) in the User Guide.

Download 2.2.331 Plug-In

^{Filename: 0208_EverpureFlashArrayPlugin_2.2.331.zip

Updated: 2026-05-15

MD5: F79549A4A46B76E5705E7141989C42C9

SHA1: 7DC95E8176612E78C62707AAAE85E51283235059

SHA256: C032A3CEEC9E0EEBA0F26F01A754F4F7F62070EBF705ABABAD547706F5DE7241}

^{Prior to version 2.2.331 the plug-in was named "Pure Storage Plug-In for Veeam Backup & Replication"}

**Pure Storage Plug-In for Veeam Backup & Replication [2.1.400]**

Addressed destroyed snapshot deletion issues on the secondary storage in SafeMode configurations.

**Pure Storage FlashArray Plug-In for Veeam Backup & Replication [2.1.388]**

What's New

Adds limited support for NFS datastores with FlashArray File Services, enabling customers to utilize USAPI capabilities with Managed Directories configured as vSphere NFS datastores for Purity 6.4.10 or later.
Note that this plug-in version does not currently support restoring from storage snapshots or replication functionality with FlashArray File Services.
Adds support for asynchronous replication for pod volumes for Purity 6.6.1 or later.

Resolved Issues

Replication relationships in setups involving both active/active asynchronous replication and automatic asynchronous replication from ActiveCluster synchronous arrays were not properly detected and processed.
A comma could not be used as a decimal delimiter on Veeam Backup & Replication servers configured with certain Windows locales, leading to formatting inconsistencies.
Auxiliary volumes were automatically added to the default protection group by default, which unnecessarily increased snapshot quota consumption.
Customers can now manually add volumes they wish to persist into the default protection groups.
Resolved the most commonly reported support issues.

**Pure Storage FlashArray Plug-In for Veeam Backup & Replication [2.0.47]**

Support for Universal Storage API v2, which enables the following additional functionality:
- Snapshot replication orchestration – allows backup jobs to leverage existing Pure Storage FlashArray Replication relationships to create storage-based snapshot replicas as additional restore points. This also enables performing backup from secondary storage arrays, to avoid any load from backup activities on the primary storage array.
  - Snapshot archiving orchestration – allows backup jobs to manage the offload of volume snapshots to a different type of storage device via Pure Storage FlashArray Offload functionality and track them there as additional available restore points.
  - Synchronous replication support – allows backup jobs to create coordinated storage snapshots and track them as additional available restore points and perform backup from volumes on both sides on dual Pure Storage FlashArray ActiveCluster configurations that serve the same production volume from multiple storage management backends.
Also, processing of snapshot deletion attempts on arrays with SafeMode enabled no longer produces job warnings and doesn't lead to an increased Veeam Backup & Replication service load.

**Pure Storage Plug-In for Veeam Backup & Replication [1.3.18]**

This update resolves the most commonly reported support issues.

**Pure Storage Plug-In for Veeam Backup & Replication [1.2.45]**

This update resolves the most common support issues and features the following enhancement:

Added support for replicated volume snapshots on the target array. For details, review KB3023.

**Pure Storage Plug-In for Veeam Backup & Replication [1.1.40]**

This update features the following enhancements:

Added support for volume snapshots created as part of a Pure Storage Protection Group.

This update also resolves the most common support issues, including the following:

The default HTTP timeout value was Increased from 5 to 60 seconds to make the plug-in more resilient to network issues.
vVol volumes are no longer displayed in the list of volumes.

**Pure Storage Plug-In for Veeam Backup & Replication [1.0.37] 2018-04-10**

Initial plug-in version

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2

2026-10-27T00:00:00Z

Vulnerabilities Resolved in Veeam Backup & Replication 13.1.2

KB ID:	4948
Product:	Veeam Backup & Replication \| 13 \| 13.1
Published:	2026-10-27
Last Modified:	2026-10-27

Veeam Software Security Commitment

Issue Details

CVE-2026-108142

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

Severity: Critical
CVSS v4.0 Score: 9.1CVSS: AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
Affected Deployment Type: Windows-based Veeam Backup & Replication | Veeam Software Appliance
Source: Reported through HackerOne.

Affected Product

Veeam Backup & Replication 13.1.1.18 and all earlier version 13.1 builds.
Veeam Backup & Replication 13.0.2.29 and all earlier version 13.0 builds.
_{Note: Older versions (e.g., 12.x) are not affected.}

Solution

This vulnerability was fixed starting in the following builds:

CVE-2026-108140

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.

Severity: Medium
CVSS v4.0 Score: 5.9CVSS: AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Affected Deployment Type: Windows-based Veeam Backup & Replication | Veeam Software Appliance
Source: Reported through HackerOne.

Affected Product

Veeam Backup & Replication 13.1.1.18 and all earlier version 13.1 builds.
Veeam Backup & Replication 13.0.2.29 and all earlier version 13.0 builds.
_{Note: Older versions (e.g., 12.x) are not affected.}

Solution

This vulnerability was fixed starting in the following builds:

CVE-2026-108141

Affected Product

Veeam Backup & Replication 13.1.1.18 and all earlier version 13.1 builds.
Veeam Backup & Replication 13.0.2.29 and all earlier version 13.0 builds.
_{Note: Older versions (e.g., 12.x) are not affected.}

Solution

This vulnerability was fixed starting in the following builds:

CVE-2026-105477

A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected.

Severity: High
CVSS v4.0 Score: 7.3CVSS: AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: Reported through HackerOne.

Affected Product

Veeam Agent for Linux 13.1.1.4 and all earlier version 13.1 builds.
_{Note: Older versions (e.g., 13.0.x and 6.x) are not affected.}

Solution

This vulnerability was fixed starting in the following build:

Veeam Agent for Linux 13.1.2 (build 13.1.2.11)

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1

2026-10-27T00:00:00Z

Vulnerabilities Resolved in Veeam ONE 13.1 P1

KB ID:	4951
Product:	Veeam ONE \| 13.1
Published:	2026-10-27
Last Modified:	2026-10-27

Veeam Software Security Commitment

Issue Details

CVE-2026-107671

A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.

Severity: High
CVSS v4.0 Score: 8.5CVSS: AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: Reported through HackerOne.

Affected Product

Veeam ONE 13.1.0.7233 and all earlier version 13.1 builds.
_{Note: Older versions (e.g., 13.0.x and 12.x) are not affected.}

Solution

This vulnerability was fixed starting in the following build:

Veeam ONE 13.1 P1 (build 13.1.0.7940)

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6

2026-10-27T00:00:00Z

Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6

KB ID:	4957
Product:	Veeam Backup for Microsoft 365 \| 8.6
Published:	2026-10-27
Last Modified:	2026-10-26

Veeam Software Security Commitment

Issue Details

CVE-2026-106076

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.

Severity: Critical
CVSS v4.0 Score: 9.0CVSS: AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: Reported through HackerOne.

Affected Product

Veeam Backup for Microsoft 365 8.5.0.1014 and all earlier version 8 builds.
_{Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable.}

Solution

This vulnerability was fixed starting in the following build:

Veeam Backup for Microsoft 365 8.6 (build 8.6.0.1102)

CVE-2026-106077

A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.

Severity: High
CVSS v4.0 Score: 8.3CVSS: AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
Source: Reported through HackerOne.

Affected Product

Veeam Backup for Microsoft 365 8.5.0.1014 and all earlier version 8 builds.
_{Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable.}

Solution

This vulnerability was fixed starting in the following build:

Veeam Backup for Microsoft 365 8.6 (build 8.6.0.1102)

CVE-2026-106078

A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.

Severity: Medium
CVSS v4.0 Score: 6.9CVSS: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: Reported through HackerOne.

Affected Product

Veeam Backup for Microsoft 365 8.6.0.1102 and all earlier version 8 builds.
_{Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable.}

Solution

This vulnerability was fixed starting in the following build:

Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011)

CVE-2025-64394

A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.

Severity: Medium
CVSS v4.0 Score: 4.3CVSS: AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Source: Reported through HackerOne.

Affected Product

Veeam Backup for Microsoft 365 8.6.0.1102 and all earlier version 8 builds.
_{Note: Unsupported product versions were not tested, but are likely affected and should be considered vulnerable.}

Solution

This vulnerability was fixed starting in the following build:

Veeam Backup for Microsoft 365 8.6 Patch 1 (build 8.6.0.5011)

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Release Information for Veeam KubeVirt Proxy

2026-10-27T00:00:00Z

Release Information for Veeam KubeVirt Proxy

KB ID:	4880
Published:	2026-10-02
Last Modified:	2026-10-28

Purpose

This article documents releases of the Veeam KubeVirt Proxy (KVP) utilized by the Veeam Plug-In for KubeVirt.

_{Note: Veeam Plug-In for KubeVirt is also know as Veeam Plug-In for Red Hat OpenShift Virtualization.}

Release Information

1.0.3

2026-10-27

Security

Updated the ubi10/ubi-minimal package to version 10.2-1792742351 to address CVE-2026-114406 and CVE-2026-77214.

Resolved Issues

When backup finalization takes longer than five minutes, the backup data mover pods are not removed. The leaked pods keep their CPU requests, so new data mover pods remain in the Pending state and new backups cannot start.
The data mover proxy process takes too long to detect changes in snapshot status, increasing the risk that the freeze could fail.
VirtualMachine settings introduced in KubeVirt 1.5 and later are not included in backups and are missing after restore.
Note: The fix is not retroactive; restore points captured with earlier Veeam KubeVirt Proxy versions still lack these settings.

1.0.2

2026-10-22

Security

Updated the following packages to address CVE-2026-111943:
- go to version v1.27.3
- ubi10/ubi-minimal to version 10.2-1792457157
Updated the following packages to address CVE-2026-100349:
- github.com/getkin/kin-openapi to version v0.151.0
- github.com/santhosh-tekuri/jsonschema/v6 to version v6.0.3

1.0.1

2026-10-02

Security

Updated the following packages to address CVE-2026-84304:
- google.golang.org/grpc to version v1.83.2
- golang.org/x/sync to version v0.22.0
- golang.org/x/sys to version v0.47.0
- golang.org/x/net to version v0.58.0
- golang.org/x/text to version v0.41.0
- golang.org/x/term to version v0.45.0
- golang.org/x/crypto to version v0.55.0
- golang.org/x/mod to version v0.38.0
- golang.org/x/tools to version v0.48.0
- google.golang.org/genproto/googleapis/rpc to version v0.0.0-20260526163538-3dc84a4a5aaa
Updated the ubi10/ubi-minimal package to version 10.2-1790556942 to address CVE-2026-14456, CVE-2026-8458, CVE-2026-74860, and CVE-2026-86140.

Resolved Issues

When the ceph-csi-config config map contains more than one entry, backup and restore of VMs on Ceph RBD storage fail to discover the Ceph cluster configuration. For example, this occurs when a cluster-mapping.json entry is included together with config.json.
Snapshots are left behind in the cluster when the VolumeSnapshotClass sets deletionPolicy: Retain.
Backups of volumes provisioned by the NetApp Trident CSI driver (csi.trident.netapp.io) leave ephemeral volumes in the ONTAP Volume Recovery Queue.
- This fix requires Trident 25.02 or later, because earlier versions ignore the trident.netapp.io/skipRecoveryQueue: "true" annotation set on the ephemeral PVCs.

Deployment Information

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Release Information for Veeam Backup for Microsoft 365 8.6 and Cumulative Patches

2026-10-27T00:00:00Z

Release Information for Veeam Backup for Microsoft 365 8.6 and Cumulative Patches

KB ID:	4913
Product:	Veeam Backup for Microsoft 365 \| 8.6
Published:	2026-09-14
Last Modified:	2026-10-27

Requirements

This release can be used to:

upgrade an existing v8, v8.1, v8.2, v8.3, v8.4, v8.5, or v8.6 deployment of Veeam Backup for Microsoft 365 to v8.6 P1.
install a new deployment of Veeam Backup for Microsoft 365 v8.6 P1.

After installing this release, the Veeam Backup for Microsoft 365 build number will be 8.6.0.5011.

Release Information

8.6.0.5011

2026-10-27

Security

CVE-2026-106078 | Severity: Medium (6.9)
A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
CVE-2025-64394 | Severity: Medium (4.3)
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.
The following .NET components were updated to version 8.0.31:
- Microsoft ASP.NET Core Runtime
- Microsoft .NET Desktop Runtime
- Microsoft .NET Runtime
The following libraries were updated:
- AngleSharp to version 1.7.2
- MailKit to version 4.16.0
- MessagePack to version 2.5.302
- MimeKit to version 4.16.0
- System.Formats.Asn1 to version 8.0.2
- System.Security.Cryptography.Xml to version 8.0.4

New Features and Enhancements

When Exchange Online does not respond to a folder export request, the affected folder is now skipped, the mailbox backup completes with a Warning status, and a restore point is created. The skipped folder is retried during the next incremental backup.
When the Sync Issues folder cannot be retrieved, the folder is now skipped and the mailbox backup creates a restore point instead of failing.
Placeholder objects left after a public folder migration from on-premises Microsoft Exchange are no longer added to the backup, which prevents the following error:
```
ErrorNonExistentMailbox
```
Public folders are now protected through the root public folder mailbox, which is displayed as a single object in the job.
Legacy bot sites (http://bot//) no longer cause SharePoint backup jobs to fail with the error:
```
This can happen if the application has not been installed by the administrator of the tenant
```
Such sites are now skipped, including when they are excluded from the backup. These sites are still displayed in the list of organization sites.
Retries of throttled Microsoft Graph and SharePoint requests that run in parallel are now spread over time to avoid repeated throttling.
SharePoint backup to a JET-based repository no longer fails after the retry window is exhausted when Microsoft Graph throttling occurs. The wait time between retries is now aligned with the delay recommended by Microsoft 365.
Calendar items with meeting attendees that have no email address are now restored with the attendee's display name only, instead of the attendees being dropped.
The Mailbox Protection report is now generated for the remaining mailboxes when a discovery mailbox has no primary SMTP address. Such mailboxes are skipped with a warning that contains the mailbox ID.
Retention tasks that resume after an interruption now skip objects that were processed in the previous run.
Improved the error message shown when OneDrive or SharePoint data is restored to a site that does not exist. The "Cannot connect to Microsoft 365" error now includes the reason "The requested site does not exist."
Veeam Backup for Microsoft 365 now identifies its requests to Microsoft Graph, Exchange Web Services, and SharePoint Online using the User-Agent format that Microsoft recommends for independent software vendors, which reduces throttling.

Bug Fixes

General

Retry delays for throttled Microsoft Graph and SharePoint requests are calculated incorrectly.
After the NATS server is unavailable for several minutes, operations that rely on the backup proxy repeatedly fail with a timeout until the proxy service is restarted.
Job sessions get stuck and do not complete when the connection between a backup proxy and the NATS server stops responding while still appearing active. The proxy does not recover until its service is restarted.

Enabling or disabling a backup job in the Veeam Backup for Microsoft 365 console fails with the error:

Unable to cast object of type 'Veeam.Archiver.Interfaces.DataContracts.JobConfig[]' to type 'System.Int32'.

A retention task on an object storage repository with SharePoint data fails with the error:
```
Cannot find versioned blob.
```

Backup and Backup Copy

When Microsoft 365 throttles requests at the start of the job, a SharePoint backup job is not retried and fails with the error:
```
Objects resolve error
```

When the personal site owner is not set in SharePoint Online, OneDrive is skipped with the error:

Failed to resolve personal site owner. The user may not have a valid Microsoft 365 license with a SharePoint plan enabled

SharePoint and OneDrive backup jobs complete with the warning:
```
Data location is undefined.
```
Backup jobs that include Microsoft 365 groups may occasionally skip some of the groups or not back up all of their members. The issue mostly affects organizations with a large number of groups.

Restore

Restoring or exporting SharePoint and OneDrive data fails with one of the following errors:
```
Cannot find a SharePoint item
```
or
```
Cannot find a folder
```
or
```
Parent of the item not found
```
The restore may also complete with a warning and restore folders without the files they contain.
When browsing a restore point, an outdated version of a SharePoint or OneDrive item may be shown as the current one.
When a mailbox is explored with the Show all versions of items that have been modified by user option enabled, restoring it to the original location leaves each item in its oldest backed-up version instead of the version from the selected restore point.
When a deleted SharePoint site is restored to the original location, the default document library is restored with a number appended to its name, and the restore completes with warnings.
When the Show deleted items and Show all versions options are enabled and a file was moved to the OneDrive root and edited between two backups, browsing or searching OneDrive data in Veeam Explorer for Microsoft OneDrive fails with the error:
```
An item with the same key has already been added
```
Restoring OneDrive data to another location fails when the name of the target folder starts with a dot.

REST APIs

Session events for a bulk mailbox restore started with the (POST) v8/RestoreSessions/{restoreSessionId}/Organization/Mailboxes/restore endpoint show "itemSizeBytes": 0 instead of the actual size of the restored data.

PowerShell and Data Management

After a repository repair, the integrity check reports SharePoint files whose actual content is an HTML error page as corrupted, even though these files were backed up correctly.
After a repository repair, some SharePoint files with corrupted data remain unrepaired, and the integrity check still reports them as corrupted. This occurs when the corrupted data is stored in a different location in the object storage repository than expected.
When an integrity check runs while a SharePoint backup job is in progress, data of some files uploaded by the job is removed, and these files are reported as having missing file data.
Repository repair logs report the same misplaced corrupted SharePoint file twice, as missing and as misplaced, and misplaced files are not taken into account in repair reports.

8.6.0.1102

2026-09-14

Release Notes for Veeam Backup for Microsoft 365 8.6

Security

CVE-2026-106077 | Severity: High (8.3)
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
CVE-2026-106076 | Severity: Critical (9.0)
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.

New Features and Enhancements

Added PowerShell cmdlets to remediate data in JET-based repositories, repositories with backup copies, and immutable repositories affected by the issue described in KB4835. For more information, see KB4874.

Veeam Backup for Microsoft 365 v8.6 includes enhanced Integrity Check capabilities that provide broader validation coverage for the issue described in KB4835. Customers who ran the Integrity Check from KB4874 with version 8.5 are strongly encouraged to upgrade to version 8.6 and rerun the Integrity Check for each applicable repository before considering the environment fully reviewed.

When an organization is added or edited, the backup app registrations in Microsoft Entra ID automatically receive the permissions required to support Exchange mailbox protection after EWS retirement. For more information, see KB4820.
Added the ability to place object storage backup repositories into maintenance mode using PowerShell cmdlets or the REST API. While a repository is in maintenance mode, Veeam Backup for Microsoft 365 blocks all operations on that repository, allowing administrators to safely perform storage-level maintenance without interference.

Bug Fixes

General

A retention task gets stuck and times out after the NATS server restarts.

Backup and Backup Copy

When the public folder hierarchy root stored in the backup no longer matches the root folder reported by Microsoft 365, public folder mailbox backup fails while processing the hierarchy root (IPM_SUBTREE) with the error:
```
Object reference not set to an instance of an object
```
In multi-geo organizations where location protection is disabled, SharePoint backup jobs fail with the error:
```
Failed to resolve sites: ambiguous locations found
```
SharePoint incremental backup jobs process all site changes from the beginning instead of continuing from the last backup point after SharePoint rejects a change token as outdated.
When redirect site URL lookups are throttled and cannot acquire a request slot within the allowed wait time, even if throttling is not reported at the tenant level, a SharePoint backup job fails at the site resolution stage with the error:
```
Request must be retried
```
In organizations with a hybrid Exchange deployment, some mailboxes are skipped during backup with the warning:
```
Exchange account was not found.
```
A backup job that fails at the resolve stage because of Microsoft 365 throttling is reported as Failed. No restore point is created and no retry is attempted, even when some objects were processed successfully.
A backup job processing SharePoint or Teams data does not trigger a retry run when all objects fail with the error:
```
Access to this site is blocked.
```
In multi-geo Microsoft 365 organizations, a throttling event in one geo region causes backup jobs in all other regions to slow down or fail.
A Teams backup job fails with an out-of-memory error when processing channels that contain a very large number of messages.
In multi-geo SharePoint environments, a backup job fails for sites whose data location cannot be resolved to any configured geo region.
A SharePoint backup job intermittently fails during the resolve stage with the error:
```
Object reference not set to an instance of an object
```
When the backup scope includes archived Microsoft Teams, a backup job fails with the error:
```
The response status code does not indicate success: 400 (Bad Request)
```

Restore

Browsing or restoring OneDrive and SharePoint data from archive-tier object storage hangs and eventually times out.
Search in Veeam Explorer for Microsoft Exchange fails with an ArgumentOutOfRangeException error when a mailbox item contains an RTF-formatted body with emoji or other characters outside the Basic Multilingual Plane.
Saving OneDrive items using Veeam Explorer for Microsoft OneDrive fails with the error:
```
Object reference not set to an instance of an object.
```

REST APIs

Advanced search across Exchange items filtered by DateReceived using an ISO-8601 UTC timestamp, for example 2025-01-02T05:59:59Z, fails with HTTP 500.
The (GET) v8/BackupRepositories/{repositoryId}/UserData REST API endpoint responds very slowly on large repositories.

PowerShell and Data Management

Repository integrity check and repair operations fail with an out-of-memory error on large repositories.

Download Information

Installation files are downloaded from My Account.

DOWNLOAD FROM MY ACCOUNT

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Release Information for Veeam Recovery Orchestrator 13 and Updates

2026-10-27T00:00:00Z

Release Information for Veeam Recovery Orchestrator 13 and Updates

KB ID:	4897
Product:	Veeam Recovery Orchestrator \| 13 \| 13.1
Published:	2026-08-05
Last Modified:	2026-10-26

Veeam Recovery Orchestrator 13 Releases

13.1.2.25

2026-10-27

Embedded component versions: Veeam Backup & Replication 13.1.2.57, Veeam ONE 13.1.0.7940

13.1.0.483

2026-07-29

Embedded component versions: Veeam Backup & Replication 13.1.0.411, Veeam ONE 13.1.0.7034

13.0.3.26

2026-08-28

Embedded component versions: Veeam Backup & Replication 13.0.3.63, Veeam ONE 13.0.2.7159

Release Notes

13.0.2.27

2026-05-27

Embedded component versions: Veeam Backup & Replication 13.0.2.29, Veeam ONE 13.0.2.6723

Resolved Issues

The cloud recovery location does not show all repositories.
The age of snapshots and replicated volumes cannot be determined in NetApp storage plans.
VM size calculation reserves too much space for replica failback, CDP failback, and restore.
Re-IP rules are not applied during DataLab tests.
Malware scan scheduling behaves incorrectly across time zones.

13.0.0.1167

2026-01-06

Embedded component versions: Veeam Backup & Replication 13.0.1.1071, Veeam ONE 13.0.1.6168

13.0.0.1005

2025-11-19

Embedded component versions: Veeam Backup & Replication 13.0.1.180, Veeam ONE 13.0.1.5860

Release Notes

Download Information

Veeam Recovery Orchestrator is distributed as the Veeam Data Platform Premium ISO. The ISO is downloaded from My Account.

Use the following ISO for:

New deployments of Veeam Recovery Orchestrator 13.1.2.25.
Upgrading existing deployments of Veeam Recovery Orchestrator 13 to 13.1.2.25.

Note: Deployments running Veeam Recovery Orchestrator 7.2.1 must be upgraded to Veeam Recovery Orchestrator 13.0.x first, and then to 13.1.2.25.

DOWNLOAD FROM MY ACCOUNT

ISO Release History

^{Previously released files are not publicly available for download. Mouse-over or tap the filenames in the table to view a file's SHA-256 checksum.}

Release Date	ISO Filename	Changelog
Veeam Recovery Orchestrator 13.1.2.25 Releases
2026-10-27	VeeamDataPlatformPremium_13.1.2.25.iso^{SHA256: BC036742481A1072F0DC908237D2110B2DD9D4A8FA03EC321A746447CF8460C2}	Initial Release
Veeam Recovery Orchestrator 13.1.0.483 Releases
2026-07-29	VeeamDataPlatformPremium_v13.1_20260728.iso^{SHA256: 6406B6BEED171D271A1EED7A9EAAC440C806FB05B94E3307A152CA35B312D863}	Initial Release
Veeam Recovery Orchestrator 13.0.3.26 Releases
2026-08-28	VeeamDataPlatformPremium_v13.0_20260817.iso^{SHA256: FB5FA235CCE7A92B71D9D348111F83B865495801F928D9A00DB3C810B66FDB08}	Initial Release
Veeam Recovery Orchestrator 13.0.2.27 Releases
2026-05-27	VeeamDataPlatformPremium_v13.0_20260527.iso^{SHA256: 46166DADCACBBDC20724F0321A8E966558FFCA63F08BA07AF963E2D4E4BC9C91}	Initial Release
Veeam Recovery Orchestrator 13.0.0.1167 Releases
2026-03-10	VeeamDataPlatformPremium_v13.0_20260310.iso^{SHA256: 85128A3784CA97728A34EC4AE8D755192C5F8A4164B8C120F67FAA8DDEBF33C6}	—
2026-01-06	VeeamDataPlatformPremium_v13.0_20260102.iso^{SHA256: 26B32AD7618708657F2E477D444260D318070E52268EFB385CCD04E4733B6111}	Initial Release
Veeam Recovery Orchestrator 13.0.0.1005 Releases
2025-12-1	VeeamDataPlatformPremium_v13.0_20251201.iso^{SHA256: 9FE23E45626C739E60FDCD7B962B9702E4E9970454031405EB655037DB3FF200}	—
2025-11-19	VeeamDataPlatformPremium_v13.0_20251118.iso^{SHA256: ACF4DBAE396262DC870B996752B81BFDA07E352AAE57AF866F64EAD948D8772B}	Initial Release

Swipe to show more of the table

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Build Numbers and Versions of Veeam Plug-In for Platform9

2026-10-27T00:00:00Z

Build Numbers and Versions of Veeam Plug-In for Platform9

KB ID:	4863
Product:	Veeam Backup & Replication \| 13.1
Published:	2026-07-29
Last Modified:	2026-10-27

This KB article lists all versions of the Veeam Plug-In for Platform9 and their respective worker build numbers.

Version	Plug-In / Worker Build	Release Date
Veeam Plug-In for Platform9 1 Releases
Veeam Plug-In for Platform9 1.1 ^{Included with Veeam Backup & Replication 13.1.2}	13.1.1.3	2026-10-27
Veeam Plug-In for Platform9 1.0 ^{Included with Veeam Backup & Replication 13.1}	13.1.0.191	2026-07-29

Swipe to show more of the table

Independent Plug-In releases are available in the My Account portal:

My Account > My Products > Additional downloads > Virtualization Plug-ins

Note: The additional downloads section is at the very bottom of the My Products page.

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Build Numbers and Versions of Veeam Plug-In for Verge OS

2026-10-27T00:00:00Z

Build Numbers and Versions of Veeam Plug-In for Verge OS

KB ID:	4862
Product:	Veeam Backup & Replication \| 13.1
Published:	2026-07-29
Last Modified:	2026-10-27

This KB article lists all versions of the Veeam Plug-In for Verge OS and their respective worker build numbers.

Version	Plug-In / Worker Build	Release Date
Veeam Plug-In for Verge OS 1 Releases
Veeam Plug-In for Verge OS 1.1 ^{Included with Veeam Backup & Replication 13.1.2}	13.1.1.3	2026-10-27
Veeam Plug-In for Verge OS 1.0 ^{Included with Veeam Backup & Replication 13.1}	13.1.0.191	2026-07-29

Swipe to show more of the table

Independent Plug-In releases are available in the My Account portal:

My Account > My Products > Additional downloads > Virtualization Plug-ins

Note: The additional downloads section is at the very bottom of the My Products page.

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Build Numbers and Versions of Veeam Plug-In for Xen

2026-10-27T00:00:00Z

Build Numbers and Versions of Veeam Plug-In for Xen

KB ID:	4891
Product:	Veeam Backup & Replication \| 13.1 Veeam Plug-In for Xen
Published:	2026-07-29
Last Modified:	2026-10-27

This KB article lists all versions of the Veeam Plug-In for Xen and their respective worker build numbers.

Version	Plug-In / Worker Build	Release Date
Veeam Plug-In for Xen 1 Releases
Veeam Plug-In for Xen 1.1 ^{Included with Veeam Backup & Replication 13.1.2}	13.1.1.7	2026-10-27
Veeam Plug-In for Xen 1.0 ^{Included with Veeam Backup & Replication 13.1}	13.1.0.295	2026-07-29

Swipe to show more of the table

Independent Plug-In releases are available in the My Account portal:

My Account > My Products > Additional downloads > Virtualization Plug-ins
Note: The additional downloads section is at the very bottom of the My Products page.

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

How to Identify and Repair Files That Cannot Be Opened After Restore

2026-10-27T00:00:00Z

How to Identify and Repair Files That Cannot Be Opened After Restore

KB ID:	4874
Product:	Veeam Backup for Microsoft 365 \| 8
Published:	2026-06-29
Last Modified:	2026-10-27

Updated for Veeam Backup for Microsoft 365 8.6

This article has been updated to document new Integrity Check capabilities included with Veeam Backup for Microsoft 365 8.6. The integrity check can now process JET-based repositories and immutable repositories.

Important: Veeam Backup for Microsoft 365 v8.6 includes enhanced Integrity Check capabilities that provide broader validation coverage for the issue described in this article. Customers who ran an Integrity Check with version 8.5 are strongly encouraged to upgrade to version 8.6 and rerun the Integrity Check for each applicable repository before considering the environment fully reviewed.

Purpose

This article provides steps to identify and repair SharePoint, OneDrive, Teams files, and list attachments that were backed up with corrupted content due to the issue described in KB4835.

Solution

Before You Begin

Ensure you’re running Veeam Backup for Microsoft 365 version 8.5 or later before proceeding.

When the Integrity Check is performed on an object storage repository, there will be a temporary increase in the number of API calls the storage system handles while previously written files are scanned for inconsistencies. The redownloading of affected files afterward also increases storage usage on that same repository.

Repair Procedure

The following steps are to be completed for each repository that contains SharePoint, OneDrive, and Teams files. The steps in this section use PowerShell commands that reference variables defined in one step and used in later steps, so all 5 steps should be completed sequentially for each repository.

In Veeam Backup for Microsoft 365 8.5, this procedure only supports non-immutable object storage repositories.
In version 8.6 and later, support for immutable object storage repositories and JET-based repositories was added.

Step 1: Run an Integrity Check

Open Veeam Backup for Microsoft 365.
In the main menu ( ☰ ), expand Console, and select PowerShell.
^{Note: Launching PowerShell from outside Veeam Backup for Microsoft 365 may require manual loading of PowerShell modules.}
In the PowerShell console, run the following command to import the module used by this article:
^{This DLL module must be loaded directly to ensure the Start-VBORepositoryRepairSession cmdlet is available.}

Import-Module "C:\Program Files\Veeam\Backup365\Veeam.Archiver.PowerShell.dll"

Run the following cmdlet for the repository being investigated:

$repository = Get-VBORepository -Name "Repository Name"
Test-VBORepository -Repository $repository

Step 2: Review the Results

If the Test-VBORepository output contains any of the following messages, proceed to Step 3:

For Veeam Backup for Microsoft 365 8.5

The following site has corrupted file data

The following list contains items referencing corrupted files

For Veeam Backup for Microsoft 365 8.6

The following site contains inconsistent file data

The following list contains items referencing inconsistent files

For Veeam Backup for Microsoft 365 8.6, the following warning is also displayed. The wording depends on the repository type.

For a JET-based repository:

WARNING: The following list contains items that reference files with incomplete downloads

For an object storage repository:

WARNING: The following list contains items referencing files with incomplete downloads

If no messages appear, no further action is required for that repository.
If you see messages other than those listed above, please contact Veeam Technical Support for assistance in investigating further.

Step 3: Scan Repository and Flag Affected Items

Use the cmdlets below to scan the repository and flag the affected items for re-backup. Their correct content will be redownloaded during the next backup job run in Step 4. Note that during scanning, the repository remains locked for any other operations, including backups, restores, and management. All backup and restore sessions related to this repository must be stopped before running a repair session.

For an object storage repository

List of Security Fixes and Improvements in Veeam ONE

2026-10-27T00:00:00Z

List of Security Fixes and Improvements in Veeam ONE

KB ID:	4858
Product:	Veeam ONE
Published:	2026-05-27
Last Modified:	2026-10-27

Purpose

This article describes all security-related fixes and improvements introduced in each release or update of Veeam ONE.

This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases to help them make an informed decision on whether it is critical to upgrade from their current Veeam ONE version to a later one.

Security Fixes and Improvements

13.1.0.7940

CVE-2026-107671 vulnerability was fixed.
BouncyCastle.Cryptography upgraded to version 2.7.0
brace-expansion upgraded to version 5.0.1
dompurify upgraded to version 3.4.15
flatted upgraded to version 3.4.4
minimatch upgraded to version 10.2.3
OpenSSL upgraded to version 3.5.9
picomatch upgraded to versions 2.3.2 and 4.0.4
uri-js was replaced with fast-uri 3.1.8
ws upgraded to version 7.5.13

13.1.0.7233

CVE-2026-65641 vulnerability was fixed.

Vulnerability Scanner False Positive after Update Install

After Veeam ONE 13.1.0.7233 is installed, some vulnerability scanners may continue to report the finding because the Veeam ONE Reporter executable remains at version 13.1.0.7034. This patch does not modify that component, so its version number is unchanged. If a scanner finding is based only on the Reporter component version, confirm that build 13.1.0.7233 is installed, and then configure an exception for that specific detection in the scanner.

13.1.0.7034

CVE-2026-64633 vulnerability was fixed.
CVE-2026-58075 vulnerability was fixed.
CVE-2026-58074 vulnerability was fixed.
CVE-2026-64631 vulnerability was fixed.
CVE-2026-64632 vulnerability was fixed.
CVE-2026-64634 vulnerability was fixed.
CVE-2026-64630 vulnerability was fixed.
AutoMapper was replaced with MagicMapper 14.0.1.
Azure.Identity upgraded to version 1.17.2
@babel/runtime upgraded to version 7.29.2
dompurify upgraded to version 3.4.11
ip-address upgraded to version 10.1.1
Microsoft.IdentityModel.JsonWebTokens upgraded to version 8.17.0
System.IdentityModel.Tokens.Jwt upgraded to version 8.17.0
System.Private.Uri upgraded to version 4.3.2
System.Security.Cryptography.Xml upgraded to version 10.0.7
vite upgraded to version 8.0.16

13.0.2.7159

CVE-2026-64633 vulnerability was fixed.
CVE-2026-58075 vulnerability was fixed.
CVE-2026-58074 vulnerability was fixed.
CVE-2026-64631 vulnerability was fixed.
CVE-2026-64632 vulnerability was fixed.
CVE-2026-64634 vulnerability was fixed.
CVE-2026-64630 vulnerability was fixed.
CVE-2026-65641 vulnerability was fixed.
d3-color upgraded to version 3.1.0
dompurify upgraded to version 3.4.11
OpenSSL upgraded to version 3.0.21
SQLite (SQLitePCLRaw e_sqlite3) upgraded to version 3.0.3

13.0.2.6723

AutoMapper was replaced with MagicMapper 14.0.1.
dompurify upgraded to version 3.4.2
postcss upgraded to version 8.5.13
System.Security.Cryptography.Xml upgraded to version 8.0.3
uuid upgraded to version 14.0.0
vite upgraded to version 4.5.14

12.3.0.7165

CVE-2026-64631 vulnerability was fixed.
CVE-2026-64632 vulnerability was fixed.
CVE-2026-58074 vulnerability was fixed.

More Information

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

List of Security Fixes and Improvements in Veeam Recovery Orchestrator

2026-10-27T00:00:00Z

List of Security Fixes and Improvements in Veeam Recovery Orchestrator

KB ID:	4857
Product:	Veeam Recovery Orchestrator
Published:	2026-05-27
Last Modified:	2026-10-27

Purpose

This article describes all security-related fixes and improvements introduced in each release or update of Veeam Recovery Orchestrator.

Security Fixes and Improvements

13.1.2.25

axios upgraded to version 1.20.0
BouncyCastle.Cryptography upgraded to version 2.7.0
dompurify upgraded to version 3.4.13
Microsoft.PowerShell.SDK upgraded to version 7.4.20 (net8.0) and 7.6.6 (net10.0)

13.1.0.483

axios upgraded to version 1.18.0
follow-redirects upgraded to version 1.16.0
form-data upgraded to version 4.0.6
happy-dom upgraded to version 20.11.0
react-router-dom upgraded to version 6.30.4
vite upgraded to version 8.0.8

13.0.3.26

dompurify upgraded to version 3.4.13
MailKit upgraded to version 4.16.0
Microsoft.AspNetCore.DataProtection.Extensions upgraded to version 8.0.29
Microsoft.PowerShell.SDK upgraded to version 7.4.18
MimeKit upgraded to version 4.16.0

13.0.2.27

System.Security.Cryptography.XML was upgraded to 9.0.16.
AutoMapper was removed.
System.Security.Cryptography.XML was upgraded to 8.0.3.
uuid was upgraded to 14.0.0.
react-router-dom was upgraded to 6.30.3.

More Information

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.