Remote arbitrary code execution affecting Veeam Backup & Replication
A vulnerability affecting Veeam Backup & Replication would allow an authenticated attacker to cause remote arbitrary code execution on affected systems.
Description
Technical context and vulnerability details
Veeam Backup & Replication is a data backup, recovery and replication solution for virtual, physical and cloud environments. This solution is affected by a vulnerability labeled CVE-2026-44963 resulting from unreliable data deserialization within backup servers integrated into an Active Directory domain. Exploitation of this vulnerability would allow an authenticated attacker with low domain privileges to remotely execute arbitrary code on affected backup servers. It is classified critical with a severity score of 9.4 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
- Breach of confidentiality and availability of data;
Affected systems
Products, components and targeted versions
- Veeam Backup & Replication versions 12.x prior to and including 12.3.2.4465 (specifically domain-integrated servers);
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Veeam Backup & Replication to its latest stable version;
- Disassociate the Veeam Backup & Replication server from the Active Directory domain, in accordance with the good security practices recommended by the publisher;
Sources & External Links
Vendor security advisories and documentation
- https://www.veeam.com/kb4869;•https://www.veeam.com/kb4696
- https://www.veeam.com/kb4869
- https://thehackernews.com/2026/06/veeam-backup-replication-rce-flaw-lets.html
- https://www.bleepingcomputer.com/news/security/new-veeam-vulnerability-exposes-backup-servers-to-rce-attacks/amp/
- https://securityaffairs.com/193385/uncategorized/critical-veeam-rce-flaw-lets-low-privilege-users-take-over-backup-servers.html
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.