Veeam Patches Critical RCE Flaw in Domain-Joined Backup Servers
Summary
CVE-2026-44963 allows a low-privileged authenticated domain user to achieve RCE on domain-joined Veeam Backup & Replication servers. Version 12.3.2.4854 fixes the flaw; 13.x is unaffected. No active exploitation has been reported.
Key points
- CVE-2026-44963 affects Veeam Backup & Replication 12.3.2.4465 and earlier version 12 builds.
- An authenticated domain user with low privileges can exploit the flaw for remote code execution on a domain-joined backup server.
- Veeam fixed the vulnerability in Backup & Replication version 12.3.2.4854.
- Veeam says version 13.x is not affected, citing architectural changes.
- The article reports no known active exploitation and relays Veeam's warning that attackers may reverse-engineer the patch.
Article Details
- Vulnerability Types
- Remote code execution
- Severity
- Critical
- Affected Versions
- Veeam Backup & Replication 12.3.2.4465 and all earlier version 12 builds
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2024-40711veeam · backup_\&_replication; Veeam · Backup and RecoveryFor instance, in November 2024, Sophos X-Ops reported that several ransomware operations, including the Akira, Fog, and Frag gangs, had weaponized another critical VBR RCE flaw (CVE-2024-40711).CVE-2026-44963Veeam · Backup and ReplicationVeeam fixed CVE-2026-44963 in Backup & Replication version 12.3.2.4854.
People
Threat Actors
AkiraSophos X-Ops reported that the Akira ransomware operation weaponized the separate Veeam Backup & Replication RCE flaw CVE-2024-40711.BlackBastaThe article names BlackBasta as a ransomware group with which FIN7 often collaborated; FIN7 has been linked to attacks targeting Veeam Backup & Replication security flaws.ContiThe article names Conti as a ransomware group with which FIN7 often collaborated; FIN7 has been linked to attacks targeting Veeam Backup & Replication security flaws.CubaThe article says the Cuba ransomware gang has been linked to attacks targeting Veeam Backup & Replication security flaws.EgregorThe article names Egregor as a ransomware group with which FIN7 often collaborated; FIN7 has been linked to attacks targeting Veeam Backup & Replication security flaws.FIN7The article says FIN7 has been linked to attacks targeting Veeam Backup & Replication security flaws and often collaborated with the Maze, Egregor, Conti, REvil, and BlackBasta ransomware groups.FogSophos X-Ops reported that the Fog ransomware operation weaponized the separate Veeam Backup & Replication RCE flaw CVE-2024-40711.FragSophos X-Ops reported that the Frag ransomware operation weaponized the separate Veeam Backup & Replication RCE flaw CVE-2024-40711.MazeThe article names Maze as a ransomware group with which FIN7 often collaborated; FIN7 has been linked to attacks targeting Veeam Backup & Replication security flaws.REvilThe article names REvil as a ransomware group with which FIN7 often collaborated; FIN7 has been linked to attacks targeting Veeam Backup & Replication security flaws.