Are backup tools (Veeam, Commvault, Acronis, Veritas) safe right now?
2 flaws were added to CISA's list of actively exploited vulnerabilities in the last 30 days. If you run backup tools, update now.
Exploited in the last 90 days
- AhsayCBSAhsay AhsayCBS Command Injection Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
- AhsayCBSAhsay AhsayCBS Improper Authentication Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
- BackupZero-dayAcronis Backup Incorrect Default Permissions Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
Earlier exploited flaws
- Commvault Command Center Path Traversal Vulnerability
- Commvault Web Server Unspecified Vulnerability Zero-day
- NAKIVO Backup and Replication Absolute Path Traversal Vulnerability
- Veeam Backup and Replication Deserialization Vulnerability
- Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability Zero-day
- Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability
- Veritas Backup Exec Agent Command Execution Vulnerability
- Veritas Backup Exec Agent Improper Authentication Vulnerability
- Veritas Backup Exec Agent File Access Vulnerability
- Veeam Backup & Replication Remote Code Execution Vulnerability
- Veeam Backup & Replication Remote Code Execution Vulnerability
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 3 | 1 |
| 2025 | 3 | 1 |
| 2024 | 2 | 1 |
| 2023 | 4 | 0 |
| 2022 | 2 | 0 |
Questions
Are backup tools (Veeam, Commvault, Acronis, Veritas) safe right now?
2 flaws were added to CISA's list of actively exploited vulnerabilities in the last 30 days. If you run backup tools, update now. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many backup tools vulnerabilities have been exploited?
14 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 7 of them used by ransomware.
Covers products matching veeam, acronis, ahsay, backup, commvault, veritas. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.