Loading vulnerability…
CVE-2023-27532 is a missing-authentication vulnerability in Veeam Backup & Replication Cloud Connect. An unauthenticated attacker able to reach the vulnerable Veeam service can obtain credentials stored in the Veeam configuration database. Recovery of these credentials can enable follow-on access to backup infrastructure and connected environments.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a C# proof-of-concept exploit for CVE-2023-27532, a critical vulnerability in Veeam Backup & Replication. The main exploit logic resides in Program.cs, which allows an attacker to connect to a Veeam Backup & Replication service over TCP (default port 9401) and either extract all stored credentials in plaintext or execute arbitrary commands as SYSTEM on the remote server. The exploit uses the Veeam remote invoke service via a net.tcp endpoint, crafting XML payloads to trigger the vulnerability. The repository includes Visual Studio project files, configuration, and references to Veeam DLLs (which must be present to build the exploit). The exploit is operational and requires network access to the vulnerable service. No detection-only scripts are present; the code is a working exploit. The Readme.md provides usage instructions and credits prior research.
This repository is a proof-of-concept (POC) exploit for CVE-2023-27532, a vulnerability in Veeam Backup & Replication. The exploit is implemented in C# (.NET 6.0) and consists of a Visual Studio solution with the main logic in 'CVE-2023-27532/Program.cs'. The exploit connects to the Veeam server's net.tcp API endpoint (default port 9401), abuses unsecured remote procedure calls ('CredentialsDbScopeGetAllCreds' and 'CredentialsDbScopeFindCredentials'), and extracts all stored credentials by deserializing the server's responses. The extracted credentials (usernames and passwords) are printed to the console. The repository includes supporting code for serialization/deserialization and the necessary service interface definitions. No authentication is required to exploit the vulnerability, making it a critical issue for unpatched Veeam servers. The README provides usage instructions, mitigation advice, and references for further technical analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Veeam Backup & Replication vulnerability for which proof-of-concept exploits were found in the adversary toolkit but were not used in this campaign.
A vulnerability referenced only through publicly available proof-of-concept repositories in the actor's broader tool library; the content does not establish its use in this campaign.
A previously patched vulnerability in Veeam Backup Software that attackers exploited on outdated Veeam Backup & Replication deployments to compromise backup infrastructure and recover stored credentials.
A specific Veeam vulnerability cited as one possible initial access vector used by ransomware operators via exploitation of public-facing applications.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.