Remote arbitrary code execution affecting Veeam Backup & Replication

Veeam Backup & Replication is a data backup, recovery and replication solution for virtual, physical and cloud environments. This solution is affected by a vulnerability labeled CVE-2026-44963 resulting from unreliable data deserialization within backup servers integrated into an Active Directory domain. Exploitation of this vulnerability would allow an authenticated attacker with low domain privileges to remotely execute arbitrary code on affected backup servers. It is classified critical with a severity score of 9.4 according to CVSS V3.1.

• Veeam Backup & Replication versions 12.x prior to and including 12.3.2.4465 (specifically domain-integrated servers);

RECOMMENDED ACTIONS:

• Update Veeam Backup & Replication to its latest stable version;
• Disassociate the Veeam Backup & Replication server from the Active Directory domain, in accordance with the good security practices recommended by the publisher;