Critical Veeam Flaw Could Let Attackers Execute Code on Backup Servers

A critical remote code execution vulnerability in Veeam Backup & Replication could allow attackers to compromise backup infrastructure, posing significant risks to enterprise environments that depend on the platform for data protection and recovery.

Veeam has disclosed the vulnerability as CVE-2026-44963, assigning it a CVSS v4 score of 9.4, which classifies it as critical. According to the official advisory (KB ID: 4869), the flaw allows an authenticated domain user to execute arbitrary code on the backup server.

This type of access could enable attackers to manipulate or delete backups, deploy ransomware, or move laterally across the network. The vulnerability was reported by security researcher Sina Kheirkhah of WatchTowr, underscoring the ongoing risk posed by compromised credentials in enterprise environments.

Affected Versions

The issue affects Veeam Backup & Replication version 12.3.2.4465 and all earlier versions 12 builds, including versions 12.0 through 12.3.1. Notably, the vulnerability affects only domain-joined backup servers, so deployments configured in a workgroup are not affected.

Veeam also confirmed that version 13.x is not vulnerable due to architectural improvements introduced in that release. However, unsupported or legacy versions are likely still exposed and should be considered at risk.

Although exploitation requires authenticated domain access, this does not significantly reduce the threat in real-world scenarios. Attackers frequently obtain valid credentials through phishing, credential dumping, or lateral movement techniques.

Once inside, they can leverage this flaw to execute commands on the backup server, tamper with or encrypt backups, establish persistence, and use the backup system as a stepping stone for further compromise. Backup infrastructure is often a primary target in ransomware attacks, as turning off recovery options increases pressure on victims to pay.

To address the issue, Veeam has released a patched version, Veeam Backup & Replication 12.3.2.4854, and strongly urges customers to upgrade immediately. Security experts warn that once patches are publicly available, attackers often reverse-engineer them to develop working exploits, making delayed patching particularly dangerous.

Organizations are advised to apply the update without delay, avoid domain-joining backup servers where possible, and enforce strict access controls. Additional measures such as network segmentation, least-privilege policies, and continuous monitoring of backup systems can help reduce the attack surface.

This vulnerability highlights the ongoing importance of securing backup infrastructure, which remains a high-value target for threat actors seeking to maximize operational disruption and financial gain.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.