CVE-2023-22793 A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System...

CriticalCVSS 9.3 EPSS 0.53%

Published: 2026-10-30 00:55
Updated: 2026-10-30 21:37
Exploit status: No public exploit known

Description

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

Affected products

Product	Affected versions	Fixed in
Veeam Management Pack for Microsoft System Center	>= 9.0, < 13.1.0.334	13.1.0.334

References

www.veeam.com

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (2)

v4.0 9.3 · hackerone
v4.0 9.3 · support@hackerone.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.53% (percentile 45.0)
CWE: CWE-502 Deserialization of Untrusted Data

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.