Unauthenticated credential extraction in Veeam Backup & Replication Cloud Connect
CVE-2023-27532 is an authentication bypass / missing authentication flaw in Veeam Backup & Replication, specifically affecting the Cloud Connect-related service/API exposed by the product. The vulnerability allows an unauthenticated remote attacker to access the local Veeam configuration database through the vulnerable API path and obtain credentials stored there. Multiple supporting references describe the issue as unauthenticated API access for credential extraction and as a missing authentication condition for a critical function. The exposed data includes credentials stored in the configuration database; some reporting describes recovery of encrypted credentials from the database, while other reporting and exploitation writeups describe attackers requesting unencrypted/plaintext credentials from the vulnerable service. In observed intrusions, attackers used PowerShell scripts and compiled tooling to pull Veeam credentials from the service and then leveraged those credentials for follow-on access and code execution within the backup environment.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a C# proof-of-concept exploit for CVE-2023-27532, a critical vulnerability in Veeam Backup & Replication. The main exploit logic resides in Program.cs, which allows an attacker to connect to a Veeam Backup & Replication service over TCP (default port 9401) and either extract all stored credentials in plaintext or execute arbitrary commands as SYSTEM on the remote server. The exploit uses the Veeam remote invoke service via a net.tcp endpoint, crafting XML payloads to trigger the vulnerability. The repository includes Visual Studio project files, configuration, and references to Veeam DLLs (which must be present to build the exploit). The exploit is operational and requires network access to the vulnerable service. No detection-only scripts are present; the code is a working exploit. The Readme.md provides usage instructions and credits prior research.
This repository is a proof-of-concept (POC) exploit for CVE-2023-27532, a vulnerability in Veeam Backup & Replication. The exploit is implemented in C# (.NET 6.0) and consists of a Visual Studio solution with the main logic in 'CVE-2023-27532/Program.cs'. The exploit connects to the Veeam server's net.tcp API endpoint (default port 9401), abuses unsecured remote procedure calls ('CredentialsDbScopeGetAllCreds' and 'CredentialsDbScopeFindCredentials'), and extracts all stored credentials by deserializing the server's responses. The extracted credentials (usernames and passwords) are printed to the console. The repository includes supporting code for serialization/deserialization and the necessary service interface definitions. No authentication is required to exploit the vulnerability, making it a critical issue for unpatched Veeam servers. The README provides usage instructions, mitigation advice, and references for further technical analysis.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Veeam Backup & Replication vulnerability enabling credential extraction, used by Akira as an alternative initial access vector.
A Veeam Backup & Replication vulnerability whose exploitation is detected via credential dump attempts followed by xp_cmdshell invocation, indicating possible successful exploitation and remote command execution or credential dumping.
Referenced in the actor’s operational notes as a potential exploit target; the report indicates the actor generally failed when attempting exploitation beyond basic automated paths.
An unauthenticated API access issue in Veeam Backup & Replication that can enable credential extraction.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.