VendorsIT management, Infrastructure

Veeam

Veeam makes backup and recovery software, chiefly Veeam Backup & Replication, Veeam ONE and Kasten for Kubernetes.

Response trend, 6 months: Not enough history
Open now: None
Latest incident: none on record
Incidents on record: 0

Response to exploited bugs

Not rated. No reviewed zero-days yet.

Fixing privately reported bugs

74 range 62–86rank 11 of 20

Provisional 3 private reports, published on 3 dates. Not enough yet for a firm grade.

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
Fixing privately reported bugs: B- (74), provisional. Median 136 days from private report to ZDI's public advisory (3 cases). 3 of 3 took longer than ZDI's 120-day deadline.
No exploited incidents on record for the last 36 months.

Response to exploited bugs: sub-scores

Time to first advisoryNo reviewed zero-days in the last 36 months
NR
0 cases, not used
Time to first fixNo reviewed zero-days in the last 36 months
NR
0 cases, not used
Time to fix all versionsNo reviewed zero-days in the last 36 months
NR
0 cases, not used
OpennessAdvisories available by RSS
62
4 cases, low confidence, not used for this vendor

Fixing privately reported bugs: sub-score

Private fix speedMedian 136 days from private report to ZDI's public advisory (3 cases)
74B−
3 cases, low confidence, weight 100%

Response fingerprint

No exploited incidents on record in the last 24 months.

Private reports

Bugs reported privately to Veeam by ZDI or Project Zero.

120-day deadlinemedian 136d

One tick per graded report. Counts to the vendor's fix when its date is known, else to publication. Taller ticks were published before a fix existed.

Published	Advisory	Product	Days from report to fix or to publication. Tick: ZDI's 120-day deadline.	Patch at publication
27 Oct 2025	ZDI-25-963CVE-2025-48982	Veeam Agent for Microsoft Windows	139to publication	Yes
24 Jul 2025	ZDI-25-625, ZDI-25-649CVE-2025-24286, CVE-2025-24287	Backup Enterprise Manager; Veeam Agent for Microsoft Windows	136to publication	Yes
12 Nov 2024	ZDI-24-1472CVE-2024-40715	Backup Enterprise Manager	123to publication	Yes

Grade history

Response to exploited bugs: score at the end of each month.

Not rated at any point in this period.

Channels

Get Veeam's own alerts

RSSVeeam Knowledge Base feed (Atom)Add the advisory feed to a feed reader or chat integration.
BlueskyVeeam on BlueskyFollow the account.
XVeeam on XFollow the account and turn on notifications.
Advisory pageVeeam Support Knowledge BaseCheck the advisory page. It has no push channel.

What we watch

BlueskyVeeam on Bluesky

See sources and health for when each was last read.