OPERATIONAL DEFECT DATABASE
...
...
This article describes all security-related fixes and improvements introduced in each release or update of Veeam Agent for Microsoft Windows. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases to help them make an informed decision on whether it is critical to upgrade from their current Veeam Agent for Microsoft Windows version to a later one.
13.0.0.835 Communication protocol was switched to gRPC OpenSSL upgraded to version 3.0.8 System.IdentityModel.Tokens.Jwt upgraded to version 8.0.2 6.3.2.1205 CVE-2025-24287 vulnerability was fixed. 6.3.0.177 Vulnerability (CVE-2024-45207) in Veeam Agent for Microsoft Windows was fixed. 6.1.2.134 Vulnerability (CVE-2024-29853) in Veeam Agent for Microsoft Windows was fixed. 6.1.0.349 OpenSSL library updated to 1.0.2zi. LZ4 library updated to 1.9.4. Stronger backup encryption. - (See pg. 7 of Veeam Backup & Replication 12.1 What's New PDF) 6.0.2.1090 OpenSSL Library updated to the newest version (1.0.2zg). 6.0.0.960 Added support for networks with NTLM authentication disabled (Kerberos-only authentication). Audit capabilities were improved. zlib has been updated to version 1.2.13. OpenSSL version has been updated to 1.0.2ze. 5.0.3.5029 OpenSSL was updated to v1.0.2zi. liblz4 was updated to v1.9.4. zlib was updated to v1.2.13. PuTTY was updated to 0.80. 5.0.3.4708 Vulnerability (CVE-2022-26503) in Veeam Agent for Microsoft Windows was fixed.This vulnerability was reported by Nikita Petrov (Positive Technologies). 5.0.0.4301 LZ4 compression library version has been updated to version 1.9.2 4.0.2.2208 Vulnerability (CVE-2022-26503) in Veeam Agent for Microsoft Windows was fixed.This vulnerability was reported by Nikita Petrov (Positive Technologies). 4.0.0.1811 A custom security descriptor was provided for the driver's control device (vulnerability reported by Mile Karry). Deserialization issues were fixed (vulnerability reported by Harrison Neal). A user authorization issue was fixed (vulnerability reported by Harrison Neal). OpenSSL was updated to version 1.0.2t
As we're establishing this new process, we appreciate any feedback on the content or format of this KB article. Please let us know in the related topic on the Veeam R&D Forums. If your feedback is too sensitive to be shared publicly, please submit it by opening a support case. We highly appreciate your collaboration!
Veeam Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.
