Veeam Patches Critical Backup & Replication RCE Flaw
Summary
Veeam patched CVE-2026-44963, a critical flaw allowing an authenticated domain user to run code on the Backup Server. It affects Backup & Replication 12.3.2.4465 and earlier 12.x builds; version 12.3.2.4854 fixes it, and 13.x is unaffected.
Key points
- CVE-2026-44963 allows an authenticated domain user to execute remote code on the Veeam Backup Server.
- The vulnerability has a CVSS score of 9.4.
- It affects Veeam Backup & Replication 12.3.2.4465 and earlier 12.x versions; 13.x builds are unaffected.
- Veeam fixed the flaw in version 12.3.2.4854.
- Veeam credited watchTowr researcher Sina Kheirkhah with discovering and reporting the issue.
Article Details
- Vulnerability Types
- Remote code execution
- Severity
- Critical (CVSS 9.4)
- Affected Versions
- Veeam Backup & Replication 12.3.2.4465 and earlier 12.x versions
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available