INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Veeam Backup RCE Flaw Exploit Allows Remote Code Execution

| 2026-06-09 16:39 CRITICAL MEDIUM
JSON
Executive Summary AI-generated
The Veeam Backup & Replication RCE flaw, identified as CVE-2026-44963, has been exploited by bad actors including ransomware groups. This critical vulnerability allows remote code execution on the Backup Server, posing a significant threat to organizations with earlier versions of 12 builds and all previous versions of 12.x. The issue was addressed in Veeam Backup & Replication version 12.3.2.4854, but prior vulnerabilities have been exploited by malicious actors, including those involved in ransomware attacks. It is essential for users to update to the latest version for optimal protection against this threat.
Technical Mitigations AI-generated
• Update to the latest version of Veeam Backup & Replication. • Ensure that users are running a version prior to 12.3.2.4854, which is not affected by this vulnerability. Note: The text does not explicitly mention any specific technical mitigations beyond updating software versions or ensuring compatibility with earlier versions. However, the following general mitigation can be inferred: • Implement secure patching and update procedures for all systems and applications to ensure timely deployment of security patches. • Conduct regular system audits and monitoring to detect potential vulnerabilities before they are exploited. • Educate users on safe computing practices, such as avoiding suspicious links or attachments, and being cautious when interacting with unknown software.
AI Podcast (EN) detail_available
detail_listen_ai (EN)
Intelligence distributed on:
Incident Link
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
FIN7FIN7 ContiContiMazeMazeEgregorEgregorREvilREvil CVE-2024-40711CVE-2024-40711 CVE-2025-23121CVE-2025-23121 CVE-2026-44963CVE-2026-44963
Target & Sectors
Global Scope
Incident Timeline
‎November 2024
Threat actors exploited a previously unknown Remote Code Execution (RCE) flaw in Veeam Backup & Replication, allowing them to gain unauthorized access to vulnerable backup servers.
tactic Ransomware
For instance, in November 2024, Sophos X-Ops reported that several ransomware operations, including the Akira, Fog , and  Frag  gangs, had weaponized another critical VBR RCE flaw (CVE-2024-40711).
organisation CVE-2024-40711
For instance, in November 2024, Sophos X-Ops reported that several ransomware operations, including the Akira, Fog , and  Frag  gangs, had weaponized another critical VBR RCE flaw (CVE-2024-40711).
organisation VBR RCE
For instance, in November 2024, Sophos X-Ops reported that several ransomware operations, including the Akira, Fog , and  Frag  gangs, had weaponized another critical VBR RCE flaw (CVE-2024-40711).
‎June 2025
Threat actors exploited a previously unknown vulnerability in Veeam's Backup & Replication solution to gain unauthorized access to backup servers.
organisation CVE-2025-23121
In June 2025, Veeam rolled out security patches to address another critical security vulnerability, tracked CVE-2025-23121 (CVSS score of 9.9) in its Backup & Replication solution that can allow remote attackers to execute arbitrary code under certain conditions.
vulnerability CVSS score of 9.9
In June 2025, Veeam rolled out security patches to address another critical security vulnerability, tracked CVE-2025-23121 (CVSS score of 9.9) in its Backup & Replication solution that can allow remote attackers to execute arbitrary code under certain conditions.
‎March 2026
Threat actors exploited a vulnerability in Veeam Backup & Replication software to gain remote access to affected backup servers.
tactic Remote Code Execution
In March 2026, Veeam resolved multiple critical vulnerabilities in Backup & Replication software that, if successfully exploited, could result in remote code execution.
‎Jun 09, 2026
Threat actors exploited a previously unknown Remote Code Execution (RCE) vulnerability in Veeam, allowing them to gain unauthorized access and potentially compromise backup servers.
‎2026/06/09
Veeam has released security patches to address a critical flaw in its Backup & Replication software that could result in remote code execution.
threat_actor FIN7
The financially motivated FIN7 threat group (which often collaborated with the Maze, Egregor, Conti, REvil, and BlackBasta ransomware groups) and the Cuba ransomware gang have also both been linked to attacks targeting VBR security flaws.
organisation Ransomware
" Often targeted in ransomware attacks Ransomware gangs have  told BleepingComputer in the past that they always target Veeam backup servers because this allows them to steal sensitive data, move within breached networks, and block restoration efforts by deleting victims' backups.
“This reality underscores the critical importance of ensuring that all customers use the latest versions of our software and install all updates and patches without delay.” Ransomware and extortion groups often target Veeam Backup & Replication because backup systems are a critical part of an organization’s recovery process.
organisation BleepingComputer
" Often targeted in ransomware attacks Ransomware gangs have  told BleepingComputer in the past that they always target Veeam backup servers because this allows them to steal sensitive data, move within breached networks, and block restoration efforts by deleting victims' backups.
organisation Vulnerability / Backup
 Ravie Lakshmanan  Jun 09, 2026 Vulnerability / Backup Software Veeam has released security patches to address a critical flaw in its Backup & Replication software that could result in remote code execution.
organisation Backup & Replication
 Ravie Lakshmanan  Jun 09, 2026 Vulnerability / Backup Software Veeam has released security patches to address a critical flaw in its Backup & Replication software that could result in remote code execution.
Veeam has released security updates to patch a critical Backup & Replication security flaw that can be exploited to gain remote code execution (RCE) on domain-joined backup servers.
Critical Veeam RCE Flaw Lets Low-Privilege Users Take Over Backup Servers Veeam addressed a critical RCE vulnerability flaw in Backup & Replication that lets low-privileged domain users take control of backup servers.
organisation the Backup
"A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user," Veeam said in a Tuesday advisory.
"A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user," Veeam said in a Tuesday advisory .
“A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.” reads the advisory .
organisation CVE-2026-44963
Veeam has patched a critical remote code execution vulnerability, tracked as CVE-2026-44963 (CVSS v4 Score of 9.4), affecting Backup & Replication version 12.x.
The vulnerability (tracked as CVE-2026-44963 and reported by WatchTowr security researcher Sina Kheirkhah) affects Veeam Backup & Replication (VBR) 12.3.2.4465 and all earlier version 12 builds, and was fixed in version 12.3.2.4854 .
infrastructure 9.4
Veeam has patched a critical remote code execution vulnerability, tracked as CVE-2026-44963 (CVSS v4 Score of 9.4), affecting Backup & Replication version 12.x.
organisation CVSS v4 Score
Veeam has patched a critical remote code execution vulnerability, tracked as CVE-2026-44963 (CVSS v4 Score of 9.4), affecting Backup & Replication version 12.x.
organisation CVSS
Tracked as CVE-2026-44963 , the vulnerability carries a CVSS score of 9.4 out of a maximum of 10.0.
infrastructure 12.3.2
The vulnerability (tracked as CVE-2026-44963 and reported by WatchTowr security researcher Sina Kheirkhah) affects Veeam Backup & Replication (VBR) 12.3.2.4465 and all earlier version 12 builds, and was fixed in version 12.3.2.4854 .
It impacts Veeam Backup & Replication 12.3.2.4465 and all earlier versions of 12 builds.
The shortcoming has been addressed in Veeam Backup & Replication version 12.3.2.4854.
The issue was fixed in version 12.3.2.4854 and does not affect Veeam Backup & Replication 13.x, which uses a different architecture.
organisation Veeam Backup & Replication
The vulnerability (tracked as CVE-2026-44963 and reported by WatchTowr security researcher Sina Kheirkhah) affects Veeam Backup & Replication (VBR) 12.3.2.4465 and all earlier version 12 builds, and was fixed in version 12.3.2.4854 .
The issue was fixed in version 12.3.2.4854 and does not affect Veeam Backup & Replication 13.x, which uses a different architecture.
Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code.
organisation WatchTowr
The vulnerability (tracked as CVE-2026-44963 and reported by WatchTowr security researcher Sina Kheirkhah) affects Veeam Backup & Replication (VBR) 12.3.2.4465 and all earlier version 12 builds, and was fixed in version 12.3.2.4854 .
WatchTowr researcher Sina Kheirkhah [@SinSinology] reported the issue.
organisation VBR
The vulnerability (tracked as CVE-2026-44963 and reported by WatchTowr security researcher Sina Kheirkhah) affects Veeam Backup & Replication (VBR) 12.3.2.4465 and all earlier version 12 builds, and was fixed in version 12.3.2.4854 .
infrastructure Windows
However, unfortunately, many companies have joined their Veeam servers to a Windows domain, ignoring Veeam's long-standing best practices .
organisation RCE
New Veeam vulnerability exposes backup servers to RCE attacks.
organisation EDR
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
victims 550,000 customers
Veeam's products are used by over 550,000 customers worldwide, including 82% of Fortune 500 companies and 74% of Global 2,000 firms.
organisation Active Directory
The flaw could allow a low-privileged domain user to execute code on backup servers connected to an Active Directory domain, potentially leading to full system compromise.
Tactical Metrics
Metrics
infrastructure
‎12.3.2
Software Version
It impacts Veeam Backup & Replication 12.3.2.4465 and all earlier versions of 12 builds.
The shortcoming has been addressed in Veeam Backup & Replication version 12.3.2.4854.
The vulnerability (tracked as CVE-2026-44963 and reported by WatchTowr security researcher Sina Kheirkhah) affects Veeam Backup & Replication (VBR) 12.3.2.4465 and all earlier version 12 builds, and was fixed in version 12.3.2.4854 .
The issue was fixed in version 12.3.2.4854 and does not affect Veeam Backup & Replication 13.x, which uses a different architecture.
Metrics
infrastructure
‎Windows
Affected Product
However, unfortunately, many companies have joined their Veeam servers to a Windows domain, ignoring Veeam's long-standing best practices .
Metrics
victims
550,000
Customers
Veeam's products are used by over 550,000 customers worldwide, including 82% of Fortune 500 companies and 74% of Global 2,000 firms.
Metrics
infrastructure
‎9.4
Software Version
Veeam has patched a critical remote code execution vulnerability, tracked as CVE-2026-44963 (CVSS v4 Score of 9.4), affecting Backup & Replication version 12.x.
Intelligence Sources
BleepingComputer 2026-06-09
Security Affairs 2026-06-09
The Hacker News 2026-06-09
The Hacker News 2026-06-09