Veeam
Data backup and recovery software company.
On 20 October, six agencies named two Veeam Backup & Replication flaws among five old weaknesses used by SafePay ransomware, which they linked to at least 600 victims.
Last refreshed: 22 October 2026 · Appears in 1 active topic
What happens when ransomware reaches the backup system first?
Timeline for Veeam
Six agencies tie SafePay to old flaws
Cybersecurity: Threats and DefencesBackground
Veeam is a US data-protection company headquartered in Kirkland, Washington. Its software covers backup, recovery and disaster-recovery work for organisations. Veeam Backup & Replication creates and restores backups across virtual, physical and cloud environments.
The product can also replicate workloads so operators have another recovery route when a primary system fails. This places Veeam inside the recovery path rather than the business applications that users handle each day. A backup platform must preserve usable copies, support restoration and remain protected from the same intruders that threaten production systems. That position explains why weaknesses in backup infrastructure carry consequences beyond the affected server itself.
Veeam flaws exposed recovery systems
A joint advisory from six US, German and UK agencies on 20 October attributed at least 600 victims to SafePay ransomware. It named five entry flaws disclosed between 2020 and 2024, including two in Veeam Backup & Replication.
All five flaws had remained on CISA's exploited-vulnerability list for two to three years. The agencies also reported that SafePay reset network-attached storage backups to factory settings. For Veeam customers, the warning joins two risks: attackers can enter through old product flaws and can then damage the recovery assets that organisations rely on after an attack.
What does Veeam Backup and Replication do?
Why was Veeam named in the SafePay advisory?
How can ransomware attacks damage backups?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.