Critical RCE Vulnerability in Veeam Backup Exposes Organizations to Attacks

Veeam has disclosed a critical vulnerability (CVE-2026-44963) affecting its Backup & Replication software, allowing authenticated domain users to execute remote code on domain-joined backup servers. This flaw impacts versions 12.3.2.4465 and earlier, with a patch available in version 12.3.2.4854. Many organizations have joined their Veeam servers to a Windows domain, contrary to best practices, making them vulnerable to exploitation. Although no active exploitation has been reported, the potential for attackers to develop exploits following the patch release is significant. Ransomware gangs have historically targeted Veeam servers to hinder recovery efforts and steal sensitive data. Veeam's products are widely used, with over 550,000 customers globally, including a large percentage of Fortune 500 companies. Security teams are urged to apply the latest updates immediately to mitigate risks.

Key Points: • CVE-2026-44963 allows remote code execution by low-privileged domain users on Veeam servers. • Veeam recommends against joining backup servers to a Windows domain, yet many organizations have done so. • A patch is available in version 12.3.2.4854, but organizations are urged to update immediately to prevent exploitation.