Medium6.8Veeam Updated

Medium [CVE-2026-58070] Vulnerability Resolved in Veeam Backup & Replication 13.1

This medium-severity Veeam advisory covers CVE-2026-58070.

KB4902 Published Aug 25, 2026

CVE-2026-58070

Affected products & platforms

VeeamBackup & Replication

Open vendor advisory

Android app · Google Play

Monitor future Veeam CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Vulnerability Resolved in Veeam Backup & Replication 13.1

KB ID: 4902

Product:

Published: 2026-08-25

Last Modified:

Veeam Software Security Commitment

Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits.

When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information.

This approach ensures that all potentially affected customers can quickly implement the necessary measures to safeguard their systems. It’s important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software.

This reality underscores the critical importance of ensuring that all customers use the latest versions of our software and install all updates and patches without delay.

Issue Details

A vulnerability that causes guest OS credentials used for Application Aware processing to be recorded in cleartext in logs on the guest machine.

Severity: Medium

CVSS v4.0 Score: 6.8CVSS: AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected versions

13.0.2.29

Official advisory · high-confidence parse· fetched 44 minutes ago·verify at source

Fixed versions

13.1

Official advisory · high-confidence parse· fetched 44 minutes ago·verify at source

Mitigation checklist

Recommended fix / mitigation

This vulnerability was fixed starting in the following builds:
Veeam Backup & Replication 13.1 (build 13.1.0.411) Veeam Backup & Replication 13.0.3 (build 13.0.3.63)

Official advisory · high-confidence parse· fetched 44 minutes ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Veeam Knowledge Base — Security Advisoriesofficial
Official vendor source used to discover this advisory; it remains the authority for affected products and remediation. Discovered from the machine-readable feed https://www.veeam.com/kb_rss; this link opens the Veeam advisory index instead of the raw feed document.
Veeam
Official vendor advisoryofficial
Official advisory page fetched and parsed; accepted detail fields are attributed to this page.
Veeam

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-58070NVD CVE.org MITRE

Official resources

Veeam Backup & Replication downloads (target: 13.1.0.411 / 13.0.3 / 13.0.3.63)
Official documentation
This advisory names 13.1.0.411 / 13.0.3 / 13.0.3.63 as the first fixed releases — official upgrade documentation for Veeam Backup & Replication.
VBR build numbers & versions (KB2680)
Knowledge base
Official build-number table — match your console's exact build against the fixed build before patching.
Veeam Knowledge Base (advisory source)
Official documentation
Canonical Veeam KB — the authoritative advisory text, affected builds and hotfixes.
Veeam Trust Center
Official documentation
Veeam's security and vulnerability-disclosure hub.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.