HKCERT, Hong Kong's computer emergency response team, said on 9 November 2026 that an attacker could trigger a denial of service condition on systems running affected Veeam products. A denial of service is an attack that keeps a system from doing its normal job. The bulletin lists seven entries. Four are Infrastructure Appliance 13.1 (Backup & Replication and Cloud Connect roles), workers from Veeam Plug-Ins for hypervisors, and Linux-based helper appliances of Backup & Replication 13.1 on Windows and of 12.3. Three are recovery media for Veeam Agent for Linux 13.1, the recovery media included with Backup & Replication 12.3, and appliances for the AWS, Google Cloud and Azure plug-ins.
The bulletin gives no CVE number, severity rating or fixed version. It does not say how the flaw is reached or whether anyone has used it. It does not say whether all seven entries are affected in the same way. HKCERT only tells readers to check the vendor's website before installing the software.
This part is our reading, not HKCERT's. Backup tools sit unused until someone needs a recovery, so an outage in restore tooling may only show up on that day. Buyers can ask two things: which of the seven entries do we run, and who watches Veeam's notice?