Veeam Upgrade Path Finder

Veeam Upgrade Path Finder — Upgrade Guidance for Veeam Products
Correct as of Aug 3, 2026
Covers 6 Veeam products
No open critical CVEs against the current build

Current release: Veeam Backup & Replication 13.1, build 13.1.0.411, generally available July 30, 2026. It’s a point release on top of the v13 architecture — over 70 changes, including expanded Microsoft Entra ID and Active Directory forest recovery coverage — rather than a from-scratch rewrite.

Two Critical-severity remote code execution CVEs were fixed earlier in the 13.x line, in 13.0.1.2067 (March 2026). If any backup server in your environment is still running a build older than that, treat patching as urgent regardless of your upgrade-to-13.1 timeline — see Security advisories below.

13.1 has just been released at the time of writing. It carries the maturity of the 13.0.x line it’s built on, but if your policy is to let a release age before touching production, 13.0.2.29 is the most field-tested alternative target and both are patched against all currently known Critical/High CVEs.

If you also run Veeam Service Provider Console, treat that separately and urgently: every build before 9.2.1.33875 carries a Critical (9.4) remote-code-execution CVE. Patch it on its own timeline rather than waiting for a coordinated VBR upgrade window.

Upgrade path finder

Pick a product, then the version you’re running today. Shows the route, the cumulative security case for moving (every relevant CVE fixed since that version), and what you gain feature-wise by reaching the current release.

Version ledger

Recent Veeam Backup & Replication builds, newest first. Sourced from Veeam’s own release-info knowledge base article (KB4738) and published release notes.

current13.1.0.411
2026-07-30
70+ features/enhancements: AD forest recovery wizard, extended Entra ID protection (org contacts, device objects, BitLocker keys), broader platform support. Release notes ↗
13.0.2.29
2026-05-27
Fixed 2 High CVEs (agent LPE, arbitrary file write). Resolved HA/PostgreSQL, NFS, object storage, and console auto-update issues. Release notes ↗
13.0.1.2067
2026-03-12
2× critical cveTwo Critical RCE vulnerabilities fixed (domain-user RCE; postgres-user RCE via Backup Viewer). Patch priority.
13.0.1.1071
2026-01-06
4 CVEs fixed (RCE as root via malicious config file; postgres RCE via crafted parameters). Tape and Hyper-V fixes.
ga13.0.1.180
2025-11-19
First general-availability update after 13.0.0. Release notes ↗
ga13.0.0.4967
2025-09-03
Veeam Backup & Replication 13 general availability — the v13 architecture baseline. Release notes ↗
12.3.2.4854
2026-06-09
Latest 12.3.2 patch — the last actively-patched build on the v12 line, and the minimum in-place upgrade base for v13.

Across the stack

VBR rarely upgrades alone. Current release, as of publication, for each companion product — sourced from each product’s own release-info KB.

currentEnterprise Manager 13.1
2026-07-30
Versioned and released alongside VBR. Upgrade requires 12.3.1+ already installed; upgrade EM before the backup servers it manages. Upgrade guide ↗
currentVeeam ONE 13.1
2026-07-30
Build 13.1.0.7034. Upgrades directly from any version 12 or later. RBAC, SSO and MFA additions in this release. Release notes ↗
currentService Provider Console 9.3
~2026-07-30
Released in the same wave as VBR 13.1. Exact build number wasn’t confirmable in this research — check the 9.3 release notes ↗ directly. Supersedes 9.2.1, which remains the critical-CVE patch floor — see Security advisories.
currentRecovery Orchestrator 13.1
~2026-07-30
Also released alongside VBR 13.1 — corrected from an earlier version of this brief, which had VRO still on 13.0.2. Release notes ↗
currentBackup for Microsoft 365 8.5
2026-06-29
Build 8.5.0.1014. Versioned independently of VBR — currently on its own v8.x line, not the v13 numbering. Upgrades in place from any 8.0–8.4 build.

Stack upgrade order

These products depend on each other, so sequence matters more than any single version number. This is the order Veeam’s own documentation implies across the products above — treat it as a starting checklist, not a substitute for your specific topology.

01
Patch Service Provider Console first, independent of everything else. If you run VSPC, its Critical CVE (9.4) is unrelated to your VBR timeline — get every instance to 9.2.1.33875 before touching anything else.
02
Upgrade Enterprise Manager before the backup servers it manages. Confirm it’s already on 12.3.1+, then move it to 13.1. Until a given backup server is also upgraded, you won’t be able to edit that server’s jobs from Enterprise Manager or the Self-Service Portal.
03
Upgrade Veeam Backup & Replication servers using the path finder below, one server at a time if you manage several.
04
Bring Veeam ONE and Recovery Orchestrator in line with your new VBR version. Both now have 13.1 releases available. If you run VRO, use the Veeam Data Platform Premium ISO rather than a standalone VBR installer so the bundled versions stay matched.
05
Veeam Backup for Microsoft 365 runs on its own schedule. It has no version dependency on VBR — upgrade it whenever convenient on its own v8.x cadence.
06
If you’re a Cloud Service Provider tenant, don’t move your VBR installation to a newer version than your provider’s Service Provider Console environment supports — confirm with them first.

Security advisories

CVEs disclosed against the v13 line, as published in Veeam’s release-info KB. All are fixed as of the current build — this list exists so you can confirm nothing older is still exposed.

Critical 9.4
CVE-2026-32998
VSPC · fixed in 9.2.1.33875
Remote code execution in Service Provider Console via the alarm script execution feature. Affects all builds before 9.2.1 — patch regardless of your VBR timeline.
Critical 9.9
CVE-2026-21669
VBR · fixed in 13.0.1.2067
Authenticated domain user can achieve remote code execution on the backup server.
Critical 9.9
CVE-2026-21708
VBR · fixed in 13.0.1.2067
Backup Viewer role can achieve RCE running as the postgres service user.
Critical 9.1
CVE-2026-21671
VBR · fixed in 13.0.1.2067
Backup Administrator role can achieve RCE specifically in high-availability (HA) deployments.
High 8.8
CVE-2026-21672
VBR · fixed in 13.0.1.2067
Local privilege escalation on Windows-based backup servers.
High 8.6
CVE-2026-32997
VBR · fixed in 13.0.2.29
Backup Administrator can write arbitrary files on the Linux-based appliance (Veeam Software Appliance).
High 9.0
CVE-2025-59470
VBR · fixed in 13.0.1.1071
Backup or Tape Operator can achieve RCE as the postgres user via a crafted interval/order parameter.
High 7.7
CVE-2026-21670
VBR · fixed in 13.0.1.2067
Low-privileged user can extract saved SSH credentials.
Medium 6.7
CVE-2025-59468
VBR · fixed in 13.0.1.1071
Backup Administrator can achieve RCE as postgres via a malicious password parameter.

Full list with KB write-ups: KB4738 — Release Information for VBR 13 and Updates ↗

Pre-upgrade checklist

Drawn from Veeam’s published upgrade checklist and the v13 upgrade guide. The in-product Upgrade Wizard checks some of these automatically — worth confirming manually first.

01
Back up the configuration database before you start. If Enterprise Manager manages this server, upgrade Enterprise Manager first — v12+ uses a new port (9405) for certificate communication with VBR, so confirm firewall rules allow it.
02
Confirm your starting build meets the in-place minimum. Direct in-place upgrade to 13.x requires 12.3.1 or 12.3.2 already installed (KB4763). Anything older needs the staged path in the finder above.
03
License file: the format introduced with v10 is unchanged through v13, so existing v10/11/12 license files continue to work — no re-licensing needed for the upgrade itself.
04
Free disk space: the installer needs room on the system disk to download and unpack the setup package, in addition to what the running product already occupies. Check the size shown on the wizard’s first step before committing.
05
PostgreSQL gets installed automatically from 12.3.2 onward (used for Microsoft Entra ID protection), even if your backup database itself is SQL Server. Account for that footprint if disk space is tight.
06
ReFS repositories on Windows Server 2019: avoid upgrading the underlying OS to Server 2022 and mounting those volumes on the new install until you’ve confirmed the known ReFS-upgrade regression is resolved in your environment.
07
Local administrator credentials are required on the target machine for both the backup server and remote console upgrades.
08
Companion products: if Veeam ONE monitors this infrastructure, check its compatibility with your target VBR version before upgrading either side. Cloud Service Provider tenants must not end up on a newer VBR build than their provider. See Stack upgrade order above for the fuller sequence across Enterprise Manager, Veeam ONE, VSPC, and Recovery Orchestrator.
09
Plan for a reboot. Windows-based upgrades may require one — schedule the maintenance window accordingly.

Known issues on 13.1

Open items called out in the current release notes — not blockers for most environments, but worth checking against your setup.

Virtual proxies can’t hot-add themselves
A virtual backup proxy can’t back up, replicate, or copy itself in virtual-appliance (hot-add) mode — jobs configured that way fall back to Network transport mode automatically.
Pool coordinator migration can suspend cluster operations
If the pool coordinator node moves from the one originally specified in your managed servers, further cluster operations pause until you accept the new coordinator’s certificate in the console.
SMAPIv3 repositories don’t support Hotadd
A platform limitation — snapshots on SMAPIv3-hosted repositories only exist in read-only mode. NBD transport is supported instead, but requires OpenSSL 3.0.9 or later (bundled with XCP-ng 8.3 LTS) and isn’t enabled by default.

Full 13.1 release notes ↗

Product lifecycle

Straight from Veeam’s own Product Lifecycle Policy page (major-version granularity — it doesn’t track point releases like 13.1 separately). Two stages: End of Fix — still supported, but no new patches, including security patches, unless Veeam determines the issue is already fixed in a newer version — and End of Support — no support at all, security or otherwise, regardless of contract.

Veeam Backup & Replication
VersionReleasedEnd of FixEnd of Support
13 current majorNov 2025Nov 2028Nov 2028
12Feb 2023Nov 2025Feb 2027
11Feb 2021Feb 2023Feb 2024 — already past End of Support
Veeam Backup Enterprise Manager — not tracked separately; ships and lifecycles alongside VBR above
Veeam ONE
VersionReleasedEnd of FixEnd of Support
13 current majorSep 2025Nov 2028Nov 2028
12Feb 2023Sep 2025Feb 2027
11Feb 2021Feb 2023Feb 2024 — already past End of Support
Veeam Service Provider Console
VersionReleasedEnd of FixEnd of Support
9 current majorSep 2025Nov 2028Nov 2028
8Dec 2023Sep 2025Dec 2026
7Feb 2023Dec 2023Feb 2026
6Sep 2021Feb 2023Sep 2024 — already past End of Support
5Feb 2021Sep 2021Feb 2024 — already past End of Support
Veeam Recovery Orchestrator
VersionReleasedEnd of FixEnd of Support
13 current majorNov 2025Nov 2028Nov 2028
7Dec 2023Nov 2025Feb 2027
6Feb 2023Dec 2023Feb 2026
Veeam Backup for Microsoft 365
VersionReleasedEnd of FixEnd of Support
8 current majorEoS in ~5 weeksSep 2024tied to next major GASep 2026
7Feb 2023Dec 2023Jun 2025 — already past End of Support

Worth acting on: as published, the entire v8.x line — the version this brief has you on right now at build 8.5.0.1014 — loses all support and security fixes in September 2026, which is only weeks away from this brief’s compile date. Check Veeam’s live lifecycle page for whether a v9 GA has since reset this date before treating it as fixed.

Sources

Every figure above traces back to one of these. Check them directly before a production upgrade — this page is a snapshot, not a live feed, and Veeam updates its own KB articles continuously.

  1. Veeam, Veeam Backup & Replication 13.1 Release Notes — system requirements, known issues, GA date.
  2. Veeam, KB4738 — Release Information for VBR 13 and Updates — full build/CVE/patch history for the v13 line.
  3. Veeam, KB2053 — VBR Upgrade Paths — official staged-upgrade routes from older versions.
  4. Veeam, KB4763 — VBR 13 In-Place Upgrade Version Requirement.
  5. Veeam, VBR 13 User Guide — Upgrade Checklist.
  6. Veeam, VBR 13 User Guide — Upgrading on Windows.
  7. Veeam Community Resource Hub, Product Updates — Veeam Backup & Replication 13.1.
  8. Veeam R&D Forums, [All Versions] Current Build thread — VBR — cross-checked build/date history.
  9. Veeam, Enterprise Manager Guide — Before You Begin (upgrade requirements).
  10. Veeam, Enterprise Manager Guide — Updating Enterprise Manager.
  11. Veeam Community Resource Hub, Product Updates — Veeam ONE 13.1.
  12. Veeam, KB4762 — Release Information for Veeam ONE 13 and Updates.
  13. Veeam, KB4853 — Vulnerability Resolved in Veeam Service Provider Console 9.2.1.
  14. Veeam, KB4788 — Release History for Veeam Service Provider Console 9.
  15. Veeam R&D Forums, [All Versions] Current Build thread — Recovery Orchestrator.
  16. Veeam, Recovery Orchestrator User Guide — Upgrade to VBR 13.
  17. Veeam R&D Forums, [Release] Current Build thread — Backup for Microsoft 365.
  18. Veeam, Backup for Microsoft 365 User Guide — Upgrading.
  19. Veeam, KB4696 — Release Information for VBR 12.3 — v12 line CVE history.
  20. CERT-EU, Security Advisories 2023-016, 2024-092, 2025-021, and 2025-038.
  21. CERT-EU, Security Advisory 2023-086 — Critical Vulnerabilities in Veeam ONE.
  22. TechRadar Pro, Veeam patches multiple critical remote code execution flaws (Sept 2024 wave, covers VBR/ONE/VSPC together).
  23. The Hacker News, Veeam Patches 7 Critical Backup & Replication Flaws (March 2026 wave).
  24. Veeam Community Resource Hub, Veeam Data Platform 13.1 is here — confirms the simultaneous VSPC 9.3 and Recovery Orchestrator 13.1 releases.
  25. ESX Virtualization, VBR 13.1 — Major Update to the Veeam Data Platform.
  26. en.vmik.net, Veeam Data Platform 13.1 Release — feature walkthrough.
  27. Veeam Community Resource Hub, Veeam ONE 13.1 — feature list.
  28. Veeam Community Resource Hub, Veeam Backup & Replication 13.1 — feature list.
  29. Veeam, Veeam Service Provider Console v9 launch blog.
  30. Veeam Community Resource Hub, Veeam Recovery Orchestrator v13 — feature list.
  31. Veeam, Veeam Product Lifecycle Policy — End of Fix / End of Support dates by major version (page last modified 2026-06-08 as fetched).
The information on this page was sourced from Veeam’s Knowledgebase — Currently it won’t update itself as new patches or CVEs ship. For anything you’re about to act on in production, click through to the live pages, especially KB4738 and the release notes, since those are the ones Veeam actually keeps current.

Leave a Reply

Discover more from Zamaan's Tech Blogs

Subscribe now to keep reading and get access to the full archive.

Continue reading