Veeam Agent for Microsoft Windows is a key component of Veeam Backup & Replication expanding its capabilities beyond virtual to protect Physical and Cloud workloads running Microsoft Windows. Kindly refer to these related guides: STANDALONE VEEAM ONE INSTALLATION: SETTING UP VEEAM ONE 11 SERVER, HOW TO UNINSTALL VEEAM BACKUP AND REPLICATION FROM YOUR SERVER, and HOW TO INSTALL AND CONFIGURE VEEAM BACKUP AND REPLICATION 11 COMMUNITY EDITION WITH ITS DEFAULT SQL SERVER EXPRESS EDITION, and VMSA-2022-0026: An arbitrary file read vulnerability in VMware Aria Operations.
Present issue
The Vulnerability (CVE-2022-26503) in Veeam Agent for Microsoft Windows allows local privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code with LOCAL SYSTEM privileges. It currently has a severity of High assigned and classified with the CVSS v3 score “7.8”. Here is a link to the fix for CVE-2022-26500 | CVE-2022-26501 vulnerability.
Cause
Veeam Agent for Microsoft Windows uses Microsoft .NET data serialization mechanisms. A local user may send malicious code to the network port opened by Veeam Agent for Windows Service (TCP 9395 by default), which will not be deserialized properly.
Note: There isn’t a workaround for the Veeam Agent vulnerability similar to Veeam Backup & Replication critical vulnerability. You will need to find a maintenance window in order to have the Veeam Agent upgraded on all affected Veeam Agent clients to remediate the vulnerability.
Solution
This vulnerability is fixed in the following Veeam Agent for Microsoft Windows patched releases:
– 5 (build 5.0.3.4708)
– 4 (build 4.0.2.2208)
Take note of the following guidance from Veeam on remediating your Veeam Agents:
- For the standalone version of Veeam Agent for Microsoft Windows (not managed by Veeam Backup & Replication), the patched release will need to be manually installed on each Veeam Agent machine.
- If your Veeam Agents are managed by Veeam Backup & Replication, you can upgrade your Veeam Agents from the Veeam Backup & Replication Console after installing the cumulative Veeam Backup & Replication patches. Ideally, install the remediated version of VBR that fixes the new critical vulnerabilities and then upgrade your Veeam Agents from there. You can also upgrade the Agents automatically if the “auto-update backup agent” setting is enabled.
Note: If you are using a version of Veeam Agent for Microsoft Windows prior to 4, please upgrade to a supported version.
I hope you found this blog post helpful. If you have any questions, please let me know in the comment session.