Question 1

How many vulnerabilities does Veeam have?

Accepted Answer

21 advisories in this record are tied by a register to a product of Veeam. That is not the same as the number of vulnerabilities the products contain, and no public source knows that number. It is the count of what has been found, disclosed and published, which depends on how much the products are examined and how openly the vendor discloses.

Question 2

Are any Veeam vulnerabilities being actively exploited?

Accepted Answer

3 of the 21 records here appear in the CISA catalogue of known exploited vulnerabilities, which lists flaws with confirmed exploitation in the wild. They are shown first in the list above. Whether any of them affects your deployment depends on the versions and components you run.

Question 3

Why does this page show fewer CVEs for Veeam than other sites?

Accepted Answer

Because a keyword search for a company name returns advisories about other companies' products that mention it in passing, and this page excludes those. 27 register entries name Veeam without naming one of its products as affected. A mirror that lists them produces a longer page and a wrong number.

Question 4

Where do the Veeam advisories on this page come from?

Accepted Answer

From European Vulnerability Database (ENISA, European Union); CERT-Bund security advisories (BSI, Federal Republic of Germany); Known Exploited Vulnerabilities catalogue (CISA, United States). Every entry links back to the register that published it, and carries the date that register states. Where the same vulnerability is held by several registers it is shown once with a link to each, rather than counted twice.

Question 5

Does a long advisory list mean Veeam is insecure?

Accepted Answer

No. A register records what researchers found and what the vendor disclosed, so a widely deployed product with a working disclosure process accumulates more entries than one nobody examines. A short list can equally mean a small install base or a vendor that publishes little. This page reports the record and does not rate the vendor, because whether this is acceptable depends on your risk appetite, your compliance scope and the alternatives you are weighing.

Register	Operated by	Entries	Latest
European Vulnerability Database	ENISA, European Union	30	Jul 22, 2026
CERT-Bund security advisories	BSI, Federal Republic of Germany	18	Jul 23, 2026
Known Exploited Vulnerabilities catalogue	CISA, United States	3	Aug 22, 2023

Veeam advisories: every record the registers tie to its products

Why this list is shorter than a CVE mirror

The full list, most recently exploited and most recent first

Which registers contributed

Questions this page answers

How many vulnerabilities does Veeam have?

Are any Veeam vulnerabilities being actively exploited?

Why does this page show fewer CVEs for Veeam than other sites?

Where do the Veeam advisories on this page come from?

Does a long advisory list mean Veeam is insecure?

A list of advisories is not a risk assessment