BugZero found this defect 800 days ago.
Data sources
All data on this page is proprietary to BugZero® or gathered from public sources
3/18/2022
Veeam Agent for Microsoft Windows
2.2
No fixed releases provided.
Vulnerability (CVE-2022-26503) in Veeam Agent for Microsoft Windows allows local privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code with LOCAL SYSTEM privileges. Severity: High CVSS v3 score: 7.8
Veeam Agent for Microsoft Windows uses Microsoft .NET data serialization mechanisms. A local user may send malicious code to the network port opened by Veeam Agent for Microsoft Windows Service (TCP 9395 by default), which will not be deserialized properly.
This vulnerability is fixed in the following Veeam Agent for Microsoft Windows patched releases:
This vulnerability was reported by Nikita Petrov (Positive Technologies).