CVE-2023-27532Vulnerability
Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability
Reported by 8 independent sources · first reported by Huntress · last reported
Last reported 2 days ago
Fix due 12 Sep 2023
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 22 Oct 2026
What the reports say
14 reports, newest first · the exact sentence from each-
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More“…volve the exploitation of known security flaws in edge device products and internet-exposed products (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766) or, alternatively, credential exposure and brute-force password attacks, for initial access, fo…”
-
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June“…ave also observed actors chaining this initial access with other exploit tools, such as those targeting Veeam backup infrastructure (CVE-2023-27532), to maximize their impact,” added Piazza.”
-
Palo Alto's firewall OS has been under attack from multiple ransomware groups since June“Unit 42 has also spotted criminals chaining this exploit for initial access with other vulnerabilities such as CVE-2023-27532, which targets Veeam backup infrastructure.”
-
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA“… the initial access method with other exploit tools, including efforts to target Veeam backup infrastructure by abusing known flaws (CVE-2023-27532) to inflict maximum damage.”
-
#StopRansomware: SafePay Ransomware“CVE-2023-27532 [CWE-306: Missing Authentication for Critical Function]”
-
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)“…ave also observed actors chaining this initial access with other exploit tools, such as those targeting Veeam backup infrastructure (CVE-2023-27532), to maximize their impact.”
-
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF“CVE-2023-27532 (PoC 1)horizon3ai/CVE-2023-27532git clone”
-
How Hastalamuerte Operates: Group-IB’s Analysis of The Gentlemen’s Attack Methods“…erences, scripts and snippets related to extraction of Veeam credentials. In addition, the criminals also shared a link to a PoC of CVE-2023-27532 affecting Veeam Backup which allows the extraction of credentials.”
-
Securing Endpoints from Common Vulnerabilities“Example of PowerShell script exploiting CVE-2023-27532 in outdated Veeam software.”
-
Untold Tales from Tactical Response“Figure 5: Image of PowerShell script exploiting CVE-2023-27532”
-
Qilin Revisited: Diving into the techniques and procedures of the recent Qilin Ransomware Attacks“Another tactic involves leveraging the CVE-2023-27532 vulnerability found in internet-facing Veeam Backup & Replication software.”
-
Patch or Peril: A Veeam vulnerability incident“CVE-2023-27532”
-
Bitter Pill“veeam.exe (45c8716c69f56e26c98369e626e0b47d7ea5e15d3fb3d97f0d5b6e8997299d1a): an executable containing code to exploit CVE-2023-27532 in Veeam software, disclosed in March 2023.”
-
Veeam Backup & Replication CVE-2023-27532 Response“Veeam Backup & Replication CVE-2023-27532 Response”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-0257, CVE-2024-40766, CVE-2020-3259, CVE-2023-20269, CVE-2024-40711, CVE-2026-81578, CVE-2026-82078, CVE-2024-4577, CVE-2024-55591
Thanks — we review every report.