CVE-2026-44963: Critical RCE in Veeam Backup Software
Enterprise backup software Veeam Backup & Replication has a critical RCE, CVE-2026-44963, CVSS 9.4. Authenticated domain users can execute arbitrary code on the backup server; ransomware groups treat these hosts as priority targets.
Incident Overview
On 14 July 2026, enterprise backup vendor Veeam published a security advisory confirming a critical remote code execution flaw in its flagship product Veeam Backup & Replication, tracked as CVE-2026-44963, CVSS v4 9.4 (Critical). WatchTowr researcher Sina Kheirkhah found the bug. Any authenticated domain user can execute arbitrary code on the backup server.
Veeam Backup & Replication is the core data-protection stack for more than 550,000 organizations worldwide, including many Fortune 500 and Global 2000 firms. Backup servers have long been a primary ransomware target—once compromised, attackers can steal sensitive data and delete or encrypt backups to force ransom payment. Groups such as FIN7 and Cuba have previously exploited older Veeam flaws (e.g. CVE-2023-27532).
Technical Details
Vulnerability Summary
CVE ID CVE-2026-44963
CVSS v4 9.4 (Critical)
Type Insecure deserialization
Attack vector Network, authenticated (domain user), low complexity
Affected component Veeam Backup Service .NET Remoting endpoint
Root Cause
Per CERT.UG technical analysis, the Veeam Backup Service .NET Remoting endpoint deserializes with BinaryFormatter, and Veeam's blocklist does not cover the gadget chain attackers use. An authenticated domain user sends a crafted serialized payload to that endpoint and triggers arbitrary code execution on the backup server.
Backup servers typically store credentials for vCenter, ESXi hosts, cloud providers, and the entire backup catalog. Successful exploitation lets an attacker:
- Fully control the backup server with SYSTEM privileges
- Access, delete, or encrypt all backup data
- Steal VM images and databases stored in the backup catalog
- Use stored credentials for lateral movement into the enterprise network
Affected Versions
- Veeam Backup & Replication 12.x: 12.3.2.4465 and all earlier 12.x builds
- Not affected: 13.x (architecture change; the vulnerable component is no longer used)
Impact Assessment
No confirmed in-the-wild exploitation of CVE-2026-44963 has been reported. Severity and attacker value mean that is likely a matter of time:
- High-value target: backup servers sit at the core of ransomware kill chains
- Low barrier: standard domain-user rights only; no admin or local account required
- Wide deployment: Veeam covers 550,000+ customers worldwide, including critical infrastructure
- Precedent: FIN7, Cuba, Akira, Fog, Frag, and other ransomware groups have exploited Veeam flaws
Remediation
Official Patch
Veeam shipped a fixed build on disclosure day. Affected users should upgrade immediately:
- Upgrade to Veeam Backup & Replication 12.3.2.4854 or later
- Longer term, migrate to 13.x, which is unaffected due to the architecture change
Temporary Mitigations
Until the patch is deployed:
- Network isolation: remove the backup server from the Active Directory domain (longstanding Veeam best practice)
- Restrict access: allow only authorized management hosts to reach Veeam Backup Service on TCP 8000
- Enable immutable backups: store critical backups in immutable repositories
- Monitor anomalies: review Veeam logs for unusual authentication and lateral-movement indicators
- Rotate credentials: proactively rotate vCenter, ESXi, and other credentials stored in Veeam
Defense in Depth
- Follow Veeam best practice: do not join the backup server to the AD domain
- Run Veeam services with least privilege
- Deploy the backup server on a separate network segment, strictly isolated from production
- Run regular restore drills to verify backup integrity and availability
References
- SecurityOnline: CVE-2026-44963 Veeam RCE details
- CyberNews: Veeam backup server RCE analysis
- CERT.UG: CVE-2026-44963 technical analysis and exploitation principle
- DBAPPSecurity: Veeam backup software critical RCE advisory