A vulnerability that may allow an attacker to utilize Server-Side Request Forgery (SSRF) to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Affects Veeam Backup for Microsoft Azure 7.1.0.22 and all earlier versions.
Severity: High
CVSS v3.1 Score: 7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: Discovered during internal testing.
This article documents how to use Veeam Agent for Microsoft Windows and Veeam Agent for Linux, managed by Veeam Backup & Replication, to protect virtual machines in XenServer and XCP-NG environments that are managed by Xen Orchestra. While these hypervisors are not directly supported for VM-level interaction by Veeam Backup & Replication, this article demonstrates how protection is possible through guest OS-level backup agents.
Xen Orchestra is a management application that provides a graphical web interface and CLI to manage XenServer and XCP-NG environments. This application works as a centralized management plane to control and monitor hosts and clusters, storage, networking, images, and virtual machines.
Veeam Agent for Microsoft Windows and Veeam Agent for Linux are components of the Veeam Data Platform that can be used to protect Windows and Linux computers that run on bare-metal hardware or virtualization platforms (including where a native host-based integration isn’t available).
Protection groups can be used to deploy and manage agents on these VMs. Protection groups come in the following types:
Adding machines individually — Used to add a handful of machines.
Integration with Microsoft Active Directory — Allows you to target AD objects (OUs/Computers/Failover Clusters/Groups)
A list of computers in a CSV file — This option can be paired with inventory management/monitoring platforms or scripts to get a list of VMs from a hypervisor platform.
Computers with Pre-installed Backup Agents — Create a deployment package that can be paired with device management or automation tools such as SCCM and Ansible/Chef/Puppet
More information on Protection Groups can be found in the user guide here: Creating Protection Groups - Veeam Agent Management Guide.
More information on Creating and Managing Backup Jobs and Policies for Veeam Agents can be found here: Working with Veeam Agent Backup Jobs and Policies - Veeam Agent Management Guide.
Xen Orchestra has a CLI that can be installed via NPM (NPM is a package management tool that’s included with Node.JS): Architecture | XO documentation (xen-orchestra.com)
This CLI tool has the capability to export information about the environment with commands such as xo-cli list-objects.
These commands can capture VM configuration info not captured via in-guest backups (IP addresses/CPU/Memory/attached disks/network IDs, etc.), and the output data can be saved to JSON files. This JSON configuration information can be copied to the Veeam server and imported into Powershell to automate Veeam backup setup and assist with the recovery of lost VMs.
An Example of how this can be used is to run the following on a Linux server with the xo-cli installed:
These files could be stored on a network share the Veeam Backup Server can access, or a Veeam File Copy job can be used to schedule copying the latest file to the Veeam Backup Server to be imported by a Powershell script using Veeam’s cmdlets.
The following is an example of how to parse the data from one of the above files to use later to automate the creation of protection groups or restore VM disks to the right Storage Repository on the Xen server:
The full list of steps to go through the Bare-Metal Recovery wizard can be found below.
Note: You may have to Manually Map volumes to the Disks.
You can enhance the Bare-Metal Recovery method by leveraging the data collected via the xo-cli or xe commands from a host to recreate VMs based on previously exported data and attaching the Veeam Recovery ISO generated from the Veeam console and uploading it to Xen Orchestra.
The restore command should look something like this example:
You’ll need the following:
xo-cli list-objects type=VM-template |grep "testvmcli" -A 40
Veeam Agents have several restore options available, including:
By adding one of the physical hypervisor servers as a managed Linux machine, the Export as virtual disk feature allows you to directly export a disk/volume as a VHD that can be restored to the Storage Repository location, such as an NFS share. The mount path for SR’s is: /run/sr-mount/<SR_UUID>, and the UUID can be found from the scripts exported previously.
After the disk is restored, it will need to be renamed by generating a new UUID on the Xen server and using a mv command to replace Veeam name with the new UUID. Example from the SR path:
If you are restoring into XCP-NG/XenServer from other platforms, make sure to install the appropriate Xen guest tools to improve performance and allow the platform to monitor the OS. XenServer and XCP-ng both have an offering: VM | XCP-ng documentation, XenServer VM Tools for Windows | Citrix Hypervisor 8.2
In Microsoft 365 organizations using modern app-only authentication, an attempt to assign the ApplicationImpersonation role, which is required for data restore with Veeam Explorer for Microsoft Exchange, fails with the following error:
Microsoft.Exchange.Management.RbacTasks.ManagementRoleDeprecatedException Error: deprecated; The management role "ApplicationImpersonation" is in the process of being deprecated. New role assignments referring this role aren't allowed.
Retention applied to a Jet-based backup repository containing SharePoint and OneDrive data may mistakenly remove the parent folders from all historical backup databases, leaving their child items orphaned. The issue may only occur under the following conditions:
Replace JobName with the name of the affected job.
During the full backup run, Veeam Backup for Microsoft 365 will automatically repair the issue in the latest and subsequent restore points for impacted objects that are still present within the production Microsoft 365 environment.
C:\ProgramData\Veeam\Backup365\Proxy.xml file, just in case changes need to be reverted or a misconfiguration occurs.Proxy.xml file, and within the <Archiver> section, add the following line under the RepositoryConfig node:
<RepositoryConfig SPJetMissingParentItemsInRoot="true" />Example end of the
Proxy.xml file:
... <RepositoryConfig SPJetMissingParentItemsInRoot="true" /> </Archiver> </Veeam>
Proxy.xml file.After upgrading Veeam Backup for Microsoft 365 to v8 (builds 8.0.2.159 or 8.0.2.200), an incremental backup or a backup copy job protecting SharePoint, OneDrive, or Teams data fails with the error:
Cannot find object ...
In Object Storage Repositories, the metadata saved for the protected SharePoint lists and webs has been mistakenly overwritten.
This issue only occurs under the following very specific conditions:
<repo_name> with the name of the potentially impacted Object Storage Repository.JobName with the name of the affected job.When installing Veeam Backup & Replication (VBR) and Veeam Backup for Microsoft 365 (VB365) on the same server, be mindful of the following compatibility when upgrading.
Note: As new versions of either product are released, they will be added to the table, and as versions reach End of Support, they will be removed. The release schedule of these products is not synchronized. If a version of either product is released before the compatible version of the other, it is critical to wait until inter-compatible versions are available. For example, if a new version of Veeam Backup & Replication is released and a compatible version of Veeam Backup for Microsoft 365 is not available yet, upgrading Veeam Backup & Replication would lead to the issue documented in KB3028.
Starting February 1, 2025, Microsoft has retired Azure AD Graph. As a result, any application relying on Azure AD Graph will be unable to make requests to its APIs, including all versions of Veeam Backup for Microsoft Azure version 5a and older.
For more information, see this Microsoft announcement.
A fix will not be released for older impacted versions of Veeam Backup for Microsoft Azure, as they reached End-of-Fix when subsequent versions were released.
Customers are advised to upgrade to Veeam Backup for Microsoft Azure version 6 (build 6.0.0.234) or newer, as these versions were designed with the Azure AD Graph API deprecation in mind and now leverage the preferred Microsoft Graph.
Veeam Backup for Microsoft Azure v6 was released alongside and is deployed by Veeam Backup & Replication 12.1 (released on 2023-12-05).
Veeam Backup for Microsoft Azure v7 was released on 2024-07-02 and is deployed by Veeam Backup & Replication 12.2, which was released 2024-08-28.
For more information about release dates, please review:
The backup of a powered-off VM within a Proxmox environment where High Availability (HA) is enabled but the HA status is Stopped, fails with the error:
Failed to perform backup: Failed to connect the NBD server to the hypervisor host.
To resolve this issue and allow the job to complete for powered-off VMs, reconfigure the Veeam Plugin for Proxmox to lock VMs during backup, informing the CRM not to trigger a stop operation.
C:\Program Files\Veeam\Plugins\PVE\Service\appsettings.json
"LockVmOnBackup": false and change it to true.The vulnerability discussed in this article affects the Veeam Updater component within the backup appliances used by the listed applications. The updated version of this Veeam Updater component will have been published to the Veeam Repository alongside the release of this announcement. As automatic updates are enabled for all backup appliances associated with this issue, all actively supported backup appliance versions will automatically download and install this updated version of the Veeam Updater component.
Furthermore, for all applications other than Veeam Backup for Salesforce, the latest version of each appliance discussed in this article is unaffected by this vulnerability. This means that customers whose Veeam Backup & Replication deployments utilize these backup appliances are unaffected if they have already upgraded to version 12.3 and updated those backup appliances.
Note: Customers who do not use any of the applications listed in the Issue Details section are entirely unaffected by this vulnerability. For information about checking whether such backup appliances are managed by Veeam Backup & Replication, please refer to the More Information section.
A vulnerability within the Veeam Updater component that allows an attacker to utilize a Man-in-the-Middle attack to execute arbitrary code on the affected appliance server with root-level permissions.
Severity: Critical
CVSS v3.1 Score: 9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: Reported by @putsi via HackerOne.
The following product's current release is affected by this vulnerability:
The following product's older releases utilize an older Veeam Updater component that was also found to be affected.
As noted below each entry, the most recent version of each of these appliances is not affected. Therefore, if Veeam Backup & Replication is running version 12.3, and the appliances for these applications have been updated, they will be running a current and unaffected version.
The vulnerability was resolved in Veeam Updater component version 7.9.0.1124.
Checking for Updates using the built-in Veeam Updater to update the Veeam Updater component.
View updates history, and check the Veeam Updater version shown in the top-right corner.
Note: If Veeam Backup & Replication 12.3 is installed, and the Veeam Backup for Nutanix AHV appliance has already been upgraded, the appliance is unaffected by this vulnerability.
The vulnerability was resolved in Veeam Updater component version 9.0.0.1125.
Checking for Updates using the built-in Veeam Updater to update the Veeam Updater component.
View updates history, and check the Veeam Updater version shown in the top-right corner.
Note: If Veeam Backup & Replication 12.3 is installed, and the AWS backup appliance has already been upgraded, the appliance is unaffected by this vulnerability.
The vulnerability was resolved in Veeam Updater component version 9.0.0.1126.
Checking for Updates using the built-in Veeam Updater to update the Veeam Updater component.
View updates history, and check the Veeam Updater version shown in the top-right corner.
Note: If Veeam Backup & Replication 12.3 is installed, and the Microsoft Azure backup appliance has already been upgraded, the appliance is unaffected by this vulnerability.
The vulnerability was resolved in Veeam Updater component version 9.0.0.1128.
Checking for Updates using the built-in Veeam Updater to update the Veeam Updater component.
View updates history, and check the Veeam Updater version shown in the top-right corner.
Note: If Veeam Backup & Replication 12.3 is installed, and the Google Cloud backup appliance has already been upgraded, the appliance is unaffected by this vulnerability.
The vulnerability was resolved in Veeam Updater component version 9.0.0.1128.
Checking for Updates using the built-in Veeam Updater to update the Veeam Updater component.
View updates history, and check the Veeam Updater version shown in the top-right corner.
Note: If Veeam Backup & Replication 12.3 is installed, and the Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization appliance has already been upgraded, the appliance is unaffected by this vulnerability.
The vulnerability was resolved in Veeam Updater component version 9.0.0.1127.
All Veeam Updater component versions equal to or higher than this are unaffected by this vulnerability.
Update the backup appliance from within the Veeam Backup & Replication Console.
To check which Veeam Updater component is used by the Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization appliance:
<log_bundle>/veeam/veeam-updater/updater.log"Starting.
Application : Veeam.Updater, Version=".Starting log. Severity threshold: Information, LogFilesNumber = 10, LogFileMaxSize = 10 Mbs, ArchivesLimit = 10 ----------------------------------------------------------------------------------------------------------------- Release version : 11.0.0.754 Application : Veeam.Updater, Version=11.0.0.754, Culture=neutral, PublicKeyToken=null
Main.main: Version:"MM.DD.YYYY HH:MM:SS [info ] ### [###] Main.main: ============= Starting ============= MM.DD.YYYY HH:MM:SS [info ] ### [###] Main.main: Version: 9.0.0.1087In this example the Veeam Updater build is less than the fixed build (9.0.0.1127) and would indicate that the Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization backup appliance needs to be updated.
If a Veeam Backup & Replication deployment is not protecting AWS, Google Cloud, Microsoft Azure, Nutanix AHV, or Oracle Linux VM/Red Hat Virtualization, such a deployment is not impacted by the vulnerability discussed in this article.
You can verify if Veeam Backup & Replication manages any of these affected backup appliances by checking the Backup Infrastructure > Managed Servers list for any of the following entry types:
Based on investigations between Veeam and Microsoft, two underlying causes have been identified.
Resilient Change Tracking monitors data changes on VHDX disks. However, depending on the specific cluster configuration, such as the disk-to-cluster-volume ratio and the available performance, an I/O bottleneck may occur.
This underlying issue was resolved in the following ways:
The I/O profile for backup operations utilizes buffered I/O, whereas the rest of the operating system employs unbuffered I/O.
This KB article lists all versions of Veeam Backup for Salesforce and their respective build numbers.
For more information on downloading the latest version of Veeam Backup for Salesforce, visit:
| Version | Build Number | Release Date | Release Notes |
| Veeam Backup for Salesforce 3 Releases | |||
| Veeam Backup for Salesforce 3.1.1 | 3.1.1.2714 | 2025-02-11 | HTML KB4697 |
| Veeam Backup for Salesforce 3.1 P20241210 | 3.1.0.2378 | 2024-12-10 | |
| Veeam Backup for Salesforce 3.1 | 3.1.0.2298 | 2024-11-27 | |
| Veeam Backup for Salesforce 3.0 | 3.0.0.1769 | 2024-09-18 | HTML |
| Veeam Backup for Salesforce 2 Releases | |||
| Veeam Backup for Salesforce 2.1.1 | 2.1.1.4793 | 2025-02-11 | |
| Veeam Backup for Salesforce 2.1 | 2.1.0.4675 | 2023-11-27 | |
| Veeam Backup for Salesforce 2 | 2.0.0.3955 | 2023-08-30 | HTML |
| Veeam Backup for Salesforce 1 Releases | |||
| Veeam Backup for Salesforce 1 P20230222 | 1.0.2.1992 | 2023-02-22 | KB4417 |
| Veeam Backup for Salesforce 1 | 1.0.0.1429 | 2022-10-27 | |
Please confirm that you are running Veeam Backup for Salesforce 3.1 (build 3.1.0.2378) or earlier before upgrading. You can find the currently installed build number in the Configuration > About section.
After the upgrade, the Veeam Backup for Salesforce build number will be 3.1.1.2714.
This release includes the following features and improvements:
This release includes the following features and improvements:
This release includes the following features and improvements:
Customers who installed Veeam Backup for Salesforce 2.x on the following distros before April 2024 won't see the upgrade notification in the product due to the expiration of GPG keys and must perform the upgrade manually.
Deployments affected by these expired GPG keys must manually upgrade Veeam Backup for Salesforce follow the steps below.