Veeam Releases Kernel Updates to Fix Critical CVE-2026-98432 Flaw Across Backup Appliances

TL;DR

Veeam released urgent updates to fix a critical Linux kernel bug in Veeam Software Appliance and related backup tools. Tracked as CVE-2026-98432 (CVSS 9.8), the flaw can cause a system crash or memory errors. Admins must install the kernel update via Veeam Updater or run the private fix right away.

Why It Matters

Veeam Software Appliance and Veeam Backup & Replication guard company data across virtual and cloud hosts. Because many Veeam tools ship with a built-in Linux kernel, OS bugs put backup safety at high risk. Both the Veeam KB4966 security advisory and the NVD database confirm the 9.8 CVSS score of this flaw.

Security researcher Marcus Hutchins reports that threat actors appear to be scanning the entire internet for systems affected by CVE-2026-98432. According to his recent post on X, residential proxies and Russia-based VPN servers began probing port 443 using MPTCP connections on November 2.

​Because standard vulnerability scanners do not use MPTCP by default, Hutchins strongly suspects this activity is tied to CVE-2026-98432. An earlier scan he conducted on October 30 identified approximately 2,102,043 servers reachable over MPTCP on port 443.

​A more detailed TLS scan narrowed that number down to roughly 762,774 servers. However, because a valid HTTP request is not required for the probe, the true scope of exposure likely sits closer to the 2.1 million mark. These figures reflect network exposure only and do not confirm whether individual kernels remain unpatched.

​While a public remote code execution exploit has not yet surfaced, multiple denial-of-service proofs-of-concept are circulating. These early proofs-of-concept provide attackers with a viable foundation for disruptive campaigns.

While exact host counts remain private, over 450,000 firms use Veeam to guard their backups.

How the Attack Works

TCP/IPv4 Connection Use-After-Free

First, the bug sits inside the network stack of the built-in Linux kernel. As the vendor advisory states, “CVE-2026-98432 is a use-after-free vulnerability in Linux kernel TCP/IPv4 connection setup (CVSS 9.8).” The report adds that “It can lead to denial of service or memory corruption.” Consequently, an attacker who sends crafted network packets during setup can crash or corrupt an unpatched host.

Affected Versions

As the vendor notes, “Veeam components that include a Linux kernel are affected.” Specifically, the flaw hits Veeam Software Appliance 13.1, Veeam Infrastructure Appliance 13.1, and plug-in workers. Furthermore, it impacts Linux helper hosts and boot media in Veeam Backup & Replication 13.1 and 12.3. Cloud plug-ins for AWS, Azure, and Google Cloud are also affected. In contrast, Veeam Kasten for Kubernetes images do not include a Linux kernel. Therefore, those images are safe.

Patch and Mitigation Steps

Since November 2, 2026, Veeam has shipped a fixed kernel through Veeam Updater for Veeam Software Appliance 13.1. To install it now, admins should open the Veeam Host Management console and click Updates. Next, click Install Updates Now and restart the host if needed. For Windows-based Veeam Backup & Replication 13.1.2.57, admins must run the November 5 private fix. A private fix for version 12.3 will arrive soon. Finally, teams must rebuild virtual labs, replace Azure helpers, and update old Linux boot media.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.