Veeam kernel update: patch the appliances your restores depend on

A Veeam backup server can be fully updated while a recovery helper still runs an older Linux kernel. Veeam’s November 6, 2026 impact statement identifies which appliances, workers and recovery media to check for CVE-2026-98432.

Advisory: Veeam KB4966, CVE-2026-98432. Published and verified: November 6, 2026. Suggested MSP priority: High for reachable backup infrastructure, especially Cloud Connect gateways and recovery appliances.

The issue is a use-after-free in Linux kernel IPv4 TCP connection setup. Veeam reports denial of service or memory corruption and cites CVSS 9.8. Canonical rates the kernel issue Critical with CVSS 3 at 9.8 and describes possible remote code execution. Veeam’s statement gives no evidence of exploitation against its products. The November 6 CISA catalog check found no listing for this CVE.

Match the fix to the deployment

• Veeam Software Appliance and Infrastructure Appliance 13.1: Veeam Updater has offered kernel 5.14.0-570.60.1+27.2.el9_6_ciq since November 2. Check Linux appliance roles such as hardened repositories, backup proxies, mount and gateway servers, and Veeam Cloud Connect gateways and WAN accelerators.
• Windows-based Backup & Replication 13.1: The affected components are the Linux helper appliances. On an existing installation, confirm build 13.1.2.57 and apply the KB4966 private fix. For new installations, use the repacked VeeamBackup&Replication_13.1.2.57_20261105.iso listed in KB4738. The filename matters because the original ISO used the same build number.
• Backup & Replication 12.3: Veeam lists its Linux helper and bundled Linux Agent recovery-media fixes as pending. Restrict network access to vulnerable helpers to the required peers while the fix is pending, and verify that recovery still works.
• Workers, cloud appliances and recovery media: Supported hypervisor plug-in workers take the updated kernel on next launch. Apply all available Veeam Updater updates on affected AWS, Azure and Google Cloud plug-in appliances and check the running Ubuntu kernel against the applicable package status. Replace Veeam Agent for Linux 13.1 recovery media created before the update.
• Kasten and customer-managed Linux: Kasten images contain no kernel. Check the Kubernetes node OS and any customer-managed Linux proxies or repositories against their distribution advisories.

Verify that the restore path is patched

1. Inventory appliances, network reachability, workers, persistent helpers and recovery media across tenants.
2. Install the applicable update, synchronize local update mirrors and restart as needed. Redeploy persistent virtual lab appliances and remove and reconfigure persistent Azure recovery helpers as Veeam directs.
3. Check Veeam Host Management update history and confirm the running kernel and redeployed helpers. Replace old recovery media and run a representative restore.

Official sources: Veeam KB4966, Veeam build and ISO history, Canonical’s kernel advisory and CISA KEV catalog data.