AI analysis
CVE-2026-93026 is a missing-authorization flaw (CWE-862) in Veeam Backup & Replication. A user who already has the low-privilege Backup Viewer role can, over the network and without further user interaction, change the Enterprise Manager master key and the credentials stored for antivirus updates. That is a high-integrity impact on the backup system (CVSS 4.0 base 6.1, medium); confidentiality and availability impacts on the vulnerable system are rated low, and no impact on subsequent systems is scored. Related reporting describes this as allowing attackers to run a malicious script, which is consistent with tampering with stored antivirus-update credentials, but the CVE text itself only confirms modification of the master key and those credentials. Affected version ranges were not included in the supplied data. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Apply Veeam’s fix for CVE-2026-93026 as soon as it is available for your build, and until then limit who holds the Backup Viewer role. Restrict network access to Veeam Backup & Replication and Enterprise Manager, and review the Enterprise Manager master key and stored antivirus update credentials for unexpected changes.
Affected
| Veeam Backup & Replication (Enterprise Manager) | — |
Estimated exposure
largeOn the order of 100,000–500,000 Veeam Backup & Replication customer deployments may run the product; confirmed vulnerable installs are unknown — Veeam publicly reports on the order of several hundred thousand customers for Backup & Replication; this issue still requires a Backup Viewer account and Enterprise Manager, and no affected-version range was provided, so the vulnerable…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.