[HIGH PRIORITY] Veeam Backup Enterprise Manager Auth Bypass (CVE-2024-5806)

⚠ HIGH PRIORITY — CISA KEV. CVE-2024-5806 is an authentication bypass in Veeam Backup Enterprise Manager on Windows and Linux backup servers. Attackers access backup consoles, steal credentials, and encrypt or exfiltrate backup repositories — catastrophic for ransomware recovery.

Affected Veeam

• Veeam Backup & Replication before 12.2.0.334
• Enterprise Manager exposed on port 9398/443
• Linux Veeam backup proxies and management servers

Check version

# Linux Veeam server
veeamconfig --version 2>/dev/null || systemctl status veeamtransport
ss -tlnp | grep 9398

Patching Method

1. Download Veeam Backup & Replication cumulative patch from Veeam portal.
2. Pause backup jobs; notify stakeholders of maintenance window.
3. On Linux: run vendor veeam-update script or mount update ISO per KB; restart Veeam services.
4. On Windows: run Veeam update installer over existing install.
5. Verify version in Console → Help → About.
6. Rotate all stored credentials in Veeam Credential Manager.
7. Audit backup job history for unauthorized restore/export operations.

systemctl restart veeamtransport veeambroker veeamdeploymentservice
grep -i 'login\|auth' /var/log/veeam/*.log 2>/dev/null | tail -20

Post-patch

• Never expose Veeam Enterprise Manager to internet
• Use separate backup account with MFA and immutable storage
• Test restore from clean backup after incident