Veeam
Data resilience vendor providing backup, recovery and ransomware protection for virtual, cloud, SaaS and physical workloads.
Certifications & Accreditations
| Certification | Certifying Body | Scope | Achieved | Expiry | Status |
|---|---|---|---|---|---|
| SOC 2 Type 2 | Not published | Company-wide per the Veeam trust center; auditor and period not published. | — | — | Current |
| ISO/IEC 27001 | Not published | Company-wide per the trust center; version year, auditor and dates not published. | — | — | Current |
| ISO/IEC 27017 | Not published | Cloud security controls; company-wide per trust center. | — | — | Current |
| ISO/IEC 27018 | Not published | Cloud PII protection; company-wide per trust center. | — | — | Current |
| ISO 22301 | Not published | Business continuity; company-wide per trust center. | — | — | Current |
| ISO/IEC 27701 | Not published | Privacy information management; company-wide per trust center. | — | — | Current |
| FIPS 140-3 | NIST CMVP | CMVP certificate #5156. | — | — | Current |
| DoDIN APL | US Department of Defense | Product-scoped to Veeam Backup & Replication v12.1. | — | — | Current |
| HIPAA/HITECH Type 2 attestation | Not published | Listed on the Veeam trust center. | — | — | Current |
Compliance Frameworks
ISO/IEC 27001:2022
Partial
Listed as company-wide but with no version year, auditor or dates published.
SOC 2 Type 2
Partial
Company-wide SOC 2 Type 2; auditor and period not published.
ISO 22301:2019
Partial
ISO 22301 listed company-wide; no certificate detail published.
GDPR 2016/679
Partial
Published DPA template; sub-processor list is inside the DPA rather than standalone.
Data Handling
Data Residency Regions
Veeam Data Cloud uses the customer-selected region of the underlying provider (Azure/AWS); on-premises products are customer-controlled
Encryption at Rest
No
Encryption in Transit
No
Incident & Breach History
| Date | Summary | Impact | Resolution | Report |
|---|---|---|---|---|
| Sept. 4, 2024 | CVE-2024-40711 (CVSS 9.8), an unauthenticated remote code execution flaw in Veeam Backup & Replication, was disclosed in KB4649 alongside 17 further CVEs. | Affected 12.1.2.172 and earlier v12. Added to CISA KEV and actively exploited by the Akira, Fog and Frag ransomware groups. The same bulletin covered CVE-2024-38650 and CVE-2024-39714 (both CVSS 9.9, Service Provider Console). | Fixed in 12.2 (build 12.2.0.334). | Report ↗ |
| March 19, 2025 | CVE-2025-23120 (CVSS 9.9), a deserialization remote code execution flaw exploitable by domain users, was patched in Veeam Backup & Replication. | Affects domain-joined backup servers — a configuration Veeam explicitly advises against. | Patch released March 2025. | — |
| March 7, 2023 | CVE-2023-27532, a credential disclosure flaw in Veeam Backup & Replication, was widely exploited and linked to FIN7 and Cuba ransomware activity. | Allowed extraction of stored credentials from the configuration database. | Patched March 2023. | — |
Contact & Responsible Disclosure
- Responsible Disclosure View policy ↗
Patch latency is the main customer risk
Veeam Backup & Replication is a **recurring, high-value ransomware target**, with multiple CVSS 9.8+ remote code execution flaws across 2023–2025 (CVE-2023-27532, CVE-2024-40711, CVE-2025-23120, CVE-2025-23121). Veeam patches promptly and publishes consolidated KB bulletins — good vendor practice — so the risk sits with **how quickly the customer or their MSP applies updates**, and with whether backup servers are domain-joined.
Veeam is a CISA Secure by Design pledge signatory. It relocated its headquarters from Baar, Switzerland to Kirkland, Washington in 2024.
Copyright © 2026 SnapGRC