Veeam warns of Software Appliance boot failures on AMD EPYC hosts
A newly disclosed flaw can give an attacker the ability to execute their own code on systems running Veeam, which is a significant vulnerability that allows for complete control.
A newly disclosed flaw can hand an attacker the ability to run their own code on systems running Veeam -- not a minor bug, the kind that gets full control.
The affected service is reachable from the network without authentication.
Veeam may already be doing an ordinary job in your environment while also being reachable from a network an attacker can access.
Veeam warned customers about boot failures affecting Software Appliance virtual machines (VMs) on hosts with AMD EPYC processors.
A restart of the guest operating system does not recover the virtual machine, Veeam added.
The company has fixed the CVE-2026-98432 flaw for some impacted Veeam components and is now pushing the patched kernel to affected systems either as a private fix or through the Veeam Updater.
Anyone running Veeam 13.1 is exposed, and because this is reachable without authentication, exposure doesn't depend on a user doing anything.
The company's Software Appliance VMs are pre-configured, Linux-based virtual machines that let admins run the Veeam Backup & Replication backup software suite on Linux devices without manually installing dependencies or configuring the software.
To comply with corporate and government security frameworks, the underlying Linux kernel runs integrated health and cryptographic checks (such as jitterentropy health tests) in FIPS mode during early boot.
What an attacker actually gains: successful exploitation allows the attacker to execute code with the permissions of the affected process.
Being reachable without authentication is what moves this from 'patch eventually' to 'patch now' -- there's no login screen standing between an attacker and the vulnerable code.
According to Veeam, users are seeing kernel panic errors on impacted systems.
This is tracked as CVE-2026-98432 and rated critical severity, which is the identifier to use when checking vendor guidance.
The affected versions are 13.1, so that's the range to check against your own deployment.
However, as the company explained in a Wednesday advisory, these VMs will fail to boot and will crash with a kernel panic after failing an early-boot FIPS-mode jitterentropy check on some AMD EPYC processors.
To mitigate this issue, Veeam told IT administrators to redeploy the appliance to a Linux host with a different processor.
If the appliance cannot be redeployed on a system with an unaffected processor, IT admins are advised to disable automatic updates for the appliance and install updates manually (while monitoring the VM as it reboots).
Confirm whether Veeam 13.1 is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
What happened
A newly disclosed flaw can give an attacker the ability to execute their own code on systems running Veeam, which is a significant vulnerability that allows for complete control.
The affected service is accessible over the network without requiring authentication.
Veeam may already be operational in your environment while also being reachable from a network accessible to an attacker.
What changed
Veeam warned customers about boot failures impacting Software Appliance virtual machines (VMs) on hosts with AMD EPYC processors.
A restart of the guest operating system does not recover the virtual machine, according to Veeam.
The company has addressed the CVE-2026-98432 flaw for some affected Veeam components and is now distributing the patched kernel to impacted systems, either as a private fix or via the Veeam Updater.
Who is affected
Anyone running Veeam 13.1 is at risk, and because this vulnerability is reachable without authentication, exposure does not rely on user actions.
The Software Appliance VMs are pre-configured, Linux-based virtual machines that enable administrators to run the Veeam Backup & Replication software suite on Linux devices without the need for manual dependency installation or software configuration.
To comply with corporate and government security frameworks, the underlying Linux kernel performs integrated health and cryptographic checks, such as jitterentropy health tests, in FIPS mode during early boot.
Why it matters
Successful exploitation grants the attacker the ability to execute code with the permissions of the affected process.
The lack of authentication transforms this from a 'patch eventually' situation to a 'patch now' scenario, as there is no login barrier between an attacker and the vulnerable code.
Veeam has reported that users are experiencing kernel panic errors on affected systems.
Technical details
This issue is tracked as CVE-2026-98432 and is rated as critical severity, which is the identifier to reference when checking vendor guidance.
The affected version is 13.1, which should be the focus when assessing your own deployment.
As explained by the company in a Wednesday advisory, these VMs will fail to boot and crash with a kernel panic after failing an early-boot FIPS-mode jitterentropy check on certain AMD EPYC processors.
Response
To mitigate this issue, Veeam advised IT administrators to redeploy the appliance to a Linux host with a different processor.
If redeployment on a system with an unaffected processor is not possible, IT admins should disable automatic updates for the appliance and manually install updates while monitoring the VM during reboot.
What security teams should do
Verify whether Veeam 13.1 is present in your asset and software inventory.
No exploitation has been reported yet, but this status could change, so it is essential to continue monitoring vendor guidance while remediation is underway.