CVE-2020-15518

8.8 highEPSS 1.0%

High (8.8) in veeam. EPSS 1.0% chance of exploitation in the next 30 days.

VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control over filesystem I/O requests.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2020-07-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

veeam:veeam_availability_suite
veeam:veeam_backup_\&_replication

References

https://zwclose.github.io/veeamon
https://zwclose.github.io/veeamon

Check your stack JSON