Security News > 2024 > June > Exploit for Veeam Recovery Orchestrator auth bypass available, patch now
A proof-of-concept exploit for a critical Veeam Recovery Orchestrator authentication bypass vulnerability tracked as CVE-2024-29855 has been released, elevating the risk of being exploited in attacks.
CVE-2024-29855, rated 9.0 as per CVSS v3.1, is an authentication bypass vulnerability impacting Veeam Recovery Orchestrator versions 7.0.0.337 and 7.1.0.205 and older.
As the exploit for CVE-2024-29855 is now publicly available, attackers will likely try to leverage it against unpatched systems, so applying the available security updates as soon as possible is crucial.
Exploit for critical Veeam auth bypass available, patch now.
Exploit for critical Progress Telerik auth bypass released, patch now.
Exploit released for maximum severity Fortinet RCE bug, patch now.
News URL
Related news
- Qualcomm Urges OEMs to Patch Critical DSP and WLAN Flaws Amid Active Exploits (source)
- Exploit code for critical GitLab auth bypass flaw released (CVE-2024-45409) (source)
- Akira and Fog ransomware now exploit critical Veeam RCE flaw (source)
- Microsoft SharePoint RCE flaw exploits in the wild – you've had 3 months to patch (source)
- Emergency patch: Cisco fixes bug under exploit in brute-force attacks (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-06-11 | CVE-2024-29855 | Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator | 0.0 |