CVE-2024-29855: Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator

PriorityP275critical9CVSS 3.0

AVNACHPRNUINSCCHIHAH

EPSS

21.63%

97.3th percentile

Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator

Affected

4 ranges

Vendor	Product	Version range	Fixed in
veeam	recovery_orchestrator	< 7.0.0.379	7.0.0.379
veeam	recovery_orchestrator	>= 7.0.0.379 < 7.0.0.379	7.0.0.379
veeam	recovery_orchestrator	>= 7.1 < 7.1.0.230	7.1.0.230
veeam	recovery_orchestrator	>= 7.1.0.230 < 7.1.0.230	7.1.0.230

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.