Veeam Agent for Microsoft Windows • Re: Veeam Agent OpenSSL vulnerabilities

Just wondered if anyone from the Veeam team can comment on the above?

I think there may have been a fundamental misunderstanding about the version of openssl.exe in Veeam Agent. Per Gostev's comment above, he believed the no-FIPS module is one of the latest versions whereas the FIPS module is 3.0.8.

This may be the case for Veeam B&R (I haven't tested) - but it is not the case for Veeam Agent for Windows! This means that VAW is shipping with a very insecure version of openssl.exe.

Statistics: Posted by willrussell — Apr 28, 2026 8:42 am

---