Vulnerabilities

CVSS

9.8 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk score

100.0

Known exploited

CISA KEV

Published

2024-09-07

Status

Analyzed

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

Weaknesses

CWE-502

Coverage 1

vulnerability

New Veeam vulnerability exposes backup servers to RCE attacks

Veeam has released security updates to patch a critical Backup & Replication security flaw that can be exploited to gain remote code execution (RCE) on domain-joined backup servers.

BleepingComputer · Jun 9, 2026 High

CVE-2026-44963CVE-2024-40711

All articles mentioning it

Advisories and references

• veeam.com/kb4649
• labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-wi...
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-...