www.veeam.com Critical RCE Vulnerability in Veeam Backup Exposes Organizations to Attacks
Article Content
- •CVE-2026-44963 allows remote code execution by low-privileged domain users on Veeam servers.
- •Veeam recommends against joining backup servers to a Windows domain, yet many organizations have done so.
- •A patch is available in version 12.3.2.4854, but organizations are urged to update immediately to prevent exploitation.
Veeam has disclosed a critical vulnerability (CVE-2026-44963) affecting its Backup & Replication software, allowing authenticated domain users to execute remote code on domain-joined backup servers. This flaw impacts versions 12.3.2.4465 and earlier, with a patch available in version 12.3.2.4854. Many organizations have joined their Veeam servers to a Windows domain, contrary to best practices, making them vulnerable to exploitation. Although no active exploitation has been reported, the potential for attackers to develop exploits following the patch release is significant. Ransomware gangs have historically targeted Veeam servers to hinder recovery efforts and steal sensitive data. Veeam's products are widely used, with over 550,000 customers globally, including a large percentage of Fortune 500 companies. Security teams are urged to apply the latest updates immediately to mitigate risks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (11)
Following this threat?
Track Akira and CVE-2024-40711 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Attackers Exploit MFA Gaps in SonicWall VPN Access On August 4, 2026, an Akira ransomware affiliate successfully accessed a SonicWall SSL VPN by spraying passwords, exploiting the lack of multi-factor authentication (MFA). After gaining access, the attacker used RDP to reach the domain controller and enumerate Active Directory, although the ransomware deployment… 
Huntress Analyzes Akira Ransomware Attack After EDR Failure In September 2026, Huntress deployed its agent at an organization already compromised by Akira ransomware. The post-compromise installation meant crucial EDR telemetry was missing, hindering initial access insights. Researchers reconstructed the attack using Windows Event Logs, Registry artifacts, and Akira log files.…