Skip to content
Edition of Sunday, November 8, 2026
Daily CISO

The five-minute briefing for security leaders.

Security vendor · Backup and cyber recovery · in CISA KEV

Veeam in the CISA KEV catalog

CISA’s Known Exploited Vulnerabilities catalog lists 4 entries for Veeam as of catalog version 2026.11.06, released November 6, 2026. The newest was added October 17, 2024, and the latest federal due date is November 7, 2024. CISA marks 4 of them as known ransomware use.

Updated

entries in the catalog
4
newest addition
October 17, 2024
latest federal due date
November 7, 2024
marked known ransomware use
4

Directory record

Website
www.veeam.com
Categories
Backup and cyber recovery (primary), Data security posture management, Incident response and forensics
Headquarters
Seattle, United States
Founded
Not established
Ownership
Owned by Insight Partners
Company record
Veeam on CISO Tribune

Directory data as of November 8, 2026. What the company sells, and the source for every fact, is on its CISO Tribune page.

KEV entries, newest first

Filed by CISA under the name “Veeam”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.

  1. Added October 17, 2024

    CVE-2024-40711 Veeam Backup and Replication Deserialization Vulnerability

    Backup & Replication · known ransomware use

    Due November 7, 2024

  2. Added August 22, 2023

    CVE-2023-27532 Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

    Backup & Replication · known ransomware use

    Due September 12, 2023

  3. Added December 13, 2022

    CVE-2022-26501 Veeam Backup & Replication Remote Code Execution Vulnerability

    Backup & Replication · known ransomware use

    Due January 3, 2023

  4. Added December 13, 2022

    CVE-2022-26500 Veeam Backup & Replication Remote Code Execution Vulnerability

    Backup & Replication · known ransomware use

    Due January 3, 2023

Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.

On Daily CISO, newest first

  1. Weekly archive · Oct 20 – Oct 26, 2025

    Veeam agrees to buy Securiti AI for $1.725 billion

  2. Weekly archive · Oct 14 – Oct 20, 2024

    CISA Adds Actively Exploited Veeam Backup Flaw to KEV Catalog

  3. Weekly archive · Sep 9 – Sep 15, 2024

    Veeam Backup & Replication RCE flaw patched amid ransomware concerns

  4. Weekly archive · Aug 21 – Aug 27, 2023

    Ivanti Sentry and Veeam bugs added to KEV Catalog

  5. Weekly archive · Mar 14 – Mar 20, 2022

    Veeam patches two critical remote code execution flaws

Sources

  1. Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
  2. Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
  3. CISO Tribune, vendor directory record for Veeam, published November 8, 2026