Veeam Vulnerability CVE-2026-98432: Critical Linux Kernel Flaw Hits Backup Appliances, and the Fixed Kernel to Install
Veeam confirms that CVE-2026-98432, a Linux kernel flaw rated 9.8, affects its Linux appliances, helper appliances and recovery media. Here is what is confirmed, what is claimed and the patches to check this week.
Where Worldwide
On this page 8 sections
Veeam has confirmed that CVE-2026-98432, a critical Linux kernel flaw rated 9.8, affects the Linux parts of its backup products, and it has released a patched kernel and fixes. If your business relies on Veeam to restore systems after ransomware or a failed server, an unpatched backup appliance could crash, or worse, at exactly the moment you need it to work.
The flaw is not in Veeam's own code. It is in the Linux kernel, which Veeam builds into its appliances and helper machines, so Veeam customers need to patch those too, separately from their servers.
What happened with the Veeam backup vulnerability
CVE-2026-98432 is a use-after-free bug in the Linux kernel's TCP/IPv4 connection setup. In plain terms, the kernel can free a piece of memory while another part of it is still reading that memory during a network connection. A bug like that can crash a system or corrupt its memory.
The timeline, from Akamai's research write-up:
- Monday, October 5, 2026: a fix was committed to the upstream Linux kernel.
- Thursday, October 15, 2026: the Linux kernel CVE Numbering Authority (CNA) published CVE-2026-98432 with a CVSS 3.1 score of 9.8.
- Monday, November 2, 2026: Akamai published its analysis, saying the flaw has existed since Linux 4.4 and was reported by a researcher at Anthropic. On the same day, Veeam's patched appliance kernel went into the Veeam repository.
- Friday, November 6, 2026: Veeam published its impact statement, KB4966.
What is confirmed and what is claimed
Confirmed by Veeam (KB4966): the flaw is rated 9.8, can cause denial of service or memory corruption, and affects the Veeam products listed in the table below. Fixes are out for 13.1. The fix for version 12.3 is not out yet.
Reported by Akamai: the bug can be triggered remotely, with no login and no user interaction. Akamai says that on October 27, 2026, Anthropic reported an exploit that lets an unauthenticated remote attacker run commands as root on servers with an MPTCP listener. MPTCP (Multipath TCP) is a networking feature that lets one connection use several network paths. That exploit has not been released, and Akamai says it is not aware of a public working exploit. Akamai also cites the Go Security Team as saying the bug is not specific to MPTCP.
Not known: Veeam's advisory says nothing about attacks on Veeam systems, and we found no primary source confirming exploitation. Veeam does not say which network conditions apply to its appliances, and it does not publish a CVSS vector string. Veeam says it is monitoring the issue and will update KB4966, so check it again before you finish patching.
Which Veeam products are affected by CVE-2026-98432
| Veeam component | Status | What to do |
|---|---|---|
| Veeam Software Appliance 13.1 | Affected until kernel updated | Install via Veeam Updater |
| Veeam Infrastructure Appliance 13.1 (proxies, hardened repositories, gateways, mount servers, WAN accelerators, Cloud Connect components) | Affected until kernel updated | Install via Veeam Updater |
| Workers deployed by hypervisor plug-ins | Affected until kernel updated | Install via Veeam Updater; workers pick up the new kernel on next launch |
| Backup & Replication 13.1 on Windows (Linux helper appliances) | Affected until private fix installed | Upgrade to 13.1.2.57, then install the private fix |
| Backup & Replication 12.3 (Linux helper appliances) | Affected | Private fix "will be made available soon" |
| Recovery media for Agent for Linux 13.1 | Affected if created before the update | Update, then recreate the media |
| Plug-ins for AWS, Microsoft Azure and Google Cloud appliances | Affected until kernel updated | Install all updates via Veeam Updater |
| Veeam Kasten for Kubernetes | Not affected (no kernel in its images) | Follow your Kubernetes node or platform vendor's advisory |
| Linux servers you manage yourself | Not a Veeam component | Follow your Linux distribution's advisory |
The fixed kernel for Veeam Software Appliance and Veeam Infrastructure Appliance 13.1 is 5.14.0-570.60.1+27.2.el9_6_ciq.
How to patch Veeam this week
- Appliances: in the Veeam Host Management console, check for updates, install them, and restart if asked. Then look at the update history to confirm the kernel package above installed.
- Don't assume it happened on its own. Veeam says Veeam Updater checks for updates every 12 hours, and by default mandatory updates install on the nearest Sunday at 14:00 in the backup server's time zone. If you use a local repository mirror, the package only arrives after the mirror syncs.
- Backup & Replication 13.1 on Windows: upgrade to build 13.1.2.57 first, then install the private fix (VeeamBackup&Replication_13.1.2.57_20261105_PrivateFix.exe). Check the file against the SHA256 hash published in KB4966. For new installs, Veeam provides repacked 13.1.2 installation media that already includes the fix.
- Helper appliances: temporary helpers get the new image the next time they are deployed. You need to redeploy persistent virtual labs, and remove and reconfigure Microsoft Azure helper appliances.
- Recovery media: recreate any Agent for Linux recovery media made before the update. That includes the boot USB or ISO kept for emergencies.
- Version 12.3: watch KB4966 for the private fix. Until it arrives, keep your Linux helper appliances on a restricted network.
- Your own Linux proxies and repositories: apply your distribution's kernel update. Akamai lists the fixed upstream releases as Linux 7.3 and stable releases 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10. Distributions often backport fixes, so go by your distribution's advisory, not the version number alone. Run
uname -rto see the kernel that is actually running.
Temporary mitigations for Linux servers you manage
For servers that cannot be patched yet, Akamai suggests setting net.mptcp.enabled=0 and net.ipv4.tcp_migrate_req=0. You can check the current values with sysctl net.mptcp.enabled and sysctl net.ipv4.tcp_migrate_req, and list MPTCP listeners with sudo ss -M -l -n -p -e. Akamai warns that turning off MPTCP alone does not prevent exploitation, and that the patched kernel is the real fix. On Veeam appliances, stick to Veeam's update path and don't change settings by hand.
Why a backup flaw matters for a business network
Your backups are what you fall back on when everything else has failed: after ransomware, a deleted database or a dead server. A hardened repository is supposed to be the copy nobody can touch. If the machine holding it can be crashed, or possibly taken over, you can no longer fully trust that copy.
This flaw also hides in places teams forget to patch. Helper appliances only start up during a restore or a test. Recovery media sits in a drawer. Cloud plug-in appliances run in another account. All three are on Veeam's affected list. If your patching only covers the servers you look at every day, these will be missed.
It is also a reminder to keep the backup network separate. Backup appliances should only accept connections from the systems that need to reach them, never from the open internet.
Veeam CVE-2026-98432 questions people are asking
Is Veeam Backup & Replication on Windows vulnerable?
The Windows server is not the problem, because the flaw is in the Linux kernel. The Linux helper appliances that Backup & Replication deploys are affected. On 13.1, upgrade to 13.1.2.57 and install the private fix.
Is CVE-2026-98432 being exploited?
Veeam's advisory does not mention exploitation. Akamai says an exploit was reported privately but has not been released, and it knew of no public working exploit as of November 2, 2026.
What is the fixed kernel for the Veeam Software Appliance?
Version 5.14.0-570.60.1+27.2.el9_6_ciq, delivered through Veeam Updater since November 2, 2026.
Is Veeam 12.3 patched?
Not yet. Veeam says the private fix for 12.3 helper appliances and recovery media "will be made available soon."
Is Veeam Kasten affected?
No. Kasten's container images do not include a kernel. Patch your Kubernetes nodes following your platform vendor's advice.
Does disabling MPTCP fix it?
No. Akamai says turning off MPTCP alone does not prevent exploitation. Install the patched kernel.
The bigger lesson
Your backup system is software too, with its own operating system, its own kernel and its own patches. Keep a list of every appliance, helper machine and recovery disk it uses, and include all of them in your monthly patching.
Want your backup and server stack reviewed and kept patched? See security hardening or request a quote.
Get security alerts like this by email, plus our free checklist, at security alerts.
Sources: Veeam KB4966: CVE-2026-98432 Impact Statement; Akamai: CVE-2026-98432 remote use-after-free in the Linux kernel TCP stack.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Fireworks AI Breach: A Hacked Cloud Provider Let Attackers Reach Customer Billing Data, Datasets and Model Weights, and What to Do Now
Fireworks AI says attackers used a hacked third-party cloud provider to reach its development machines and cus...
iPhone Exploit Kits: Leaked DarkSword Code Reached an Employee's iPhone Through an Instagram Ad, and How to Lock Down Work Phones
Criminals are now using leaked iPhone exploit kits built for spies to break into out-of-date iPhones through a...
iOS App Sandbox Bypass: Public worse_query Code Reaches Other Apps' Data on iOS 26 and 27.2, No Apple Fix Confirmed, and What to Do This Week
A developer has published worse_query, proof-of-concept code that lets an iPhone app reach other apps' data on...
