Veeam Recovery Orchestrator — known CVE vulnerabilities

Every CVE whose affected-product data names Veeam Recovery Orchestrator, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2024-29855 — CVSS 9.0 (critical): Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator
• CVE-2024-22022 — CVSS 8.8 (high): Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash…
• CVE-2024-22021 — CVSS 4.3 (medium): Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a…