How do you patch or mitigate CVE-2022-26501 (Veeam Backup & Replication Remote Code Execution)?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

CISA's required action for CVE-2022-26501 is to apply updates per vendor instructions. In practice, find every instance of Veeam Backup & Replication in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What to check before you patch Veeam Backup & Replication

Start with simple exposure confirmation. Identify every Veeam Backup & Replication installation, note whether it is internet reachable, and confirm whether it is still needed in production. For an exploited vulnerability, the biggest mistake is assuming the patch decision is uniform across the estate when backup servers often sit in separate trust zones and have unusually broad access.

When the product is exposed externally, treat it as a higher-priority remediation path than an internal-only deployment. For this kind of remote code execution issue, the question is not only whether the software is present, but whether an attacker can reach it, authenticate to it, or use it as an entry point into backup infrastructure and the systems it protects.

How to apply the fix or mitigation safely

The primary action is to apply the vendor update or documented mitigation exactly as directed, then verify that the deployed state matches the advisory rather than relying on change tickets alone. For this class of issue, patching is only complete when the affected instance is updated, the service is reachable only by intended administrative paths, and the change has been validated against the actual host or appliance.

If you cannot patch immediately, remove internet exposure or take the product out of service until you can. That is often the right trade-off for backup tooling because availability pressure can tempt teams to defer remediation, yet remote code execution on a backup platform can create far greater blast radius than a short maintenance outage.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog to confirm the required action and current remediation guidance, and use the NIST National Vulnerability Database and CVE Program for authoritative record details.

What to do after patching and why verification matters

After remediation, review logs, authentication traces, scheduled tasks, service changes, and unusual backup administration activity for signs of earlier exploitation. The reason is straightforward: when a flaw has been used in the wild, the patch closes the door going forward, but it does not tell you whether an attacker already walked through it.

Look for suspicious execution from the backup server, unexpected administrative account use, new local users, altered backup jobs, disabled security tooling, or signs that backup credentials were accessed or reused elsewhere. If you find evidence of compromise, treat it as an incident with potential data-restoration and domain-wide consequences, not as a routine patch verification exercise.

Risk and Threat Considerations

Remote code execution on a backup platform is especially dangerous because the affected system often has privileged access, broad network reach, and high operational trust. If an attacker can execute code there, they may be able to tamper with backups, harvest credentials, or use the server as a pivot into the rest of the environment.

Failure mechanism: The vulnerability becomes exploitable when a reachable Veeam instance can be targeted before it is updated or isolated, allowing arbitrary code execution and follow-on access to backup data and adjacent systems.

Impact: Attackers can disrupt recovery, destroy confidence in backups, and expand compromise beyond the original server, which is why exploited backup software should be treated as a major containment and recovery risk.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Requires timely remediation of exploited software flaws.
	RA-5 — Vulnerability Monitoring and Scanning	Supports finding every exposed instance and verifying remediation status.
	AU-6 — Audit Record Review, Analysis, and Reporting	Supports post-patch log review for earlier exploitation signs.
Recommendation — Apply vendor updates and document remediation for the affected Veeam instance. Scan the estate to confirm every Veeam deployment is identified and tracked. Review audit and service logs for evidence of prior compromise.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Directly covers prioritising and remediating actively exploited vulnerabilities.
	CIS-12 — Network Infrastructure Management	Supports removing internet exposure when patching must wait.
Recommendation — Prioritise the exposed Veeam host for rapid remediation and verification. Restrict network reachability until the affected system is remediated.

Practitioner Guidance

What to prioritise: Patch or isolate the most exposed Veeam instances first, especially any system with internet exposure or a direct path into production backup repositories.

What to verify: Confirm that the fix is present on the live host, that remote management paths are restricted, and that backup jobs still run successfully after the change.

Decision rule: If patching cannot happen immediately, prefer temporary removal from external access over accepting continued exposure, because the consequence of compromise is typically worse than a short outage.

Practitioner takeaway: With backup software, the remediation goal is not only closing the CVE, but preserving trust in the recovery chain, so validate both exposure reduction and compromise indicators before declaring the issue contained.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org