Critical Unauthenticated RCE Flaws Expose Veeam Backup & Recovery and Node.js MCP Server

Two critical vulnerabilities were disclosed that allow unauthenticated remote code execution against exposed systems. CVE-2024-40711 affects Veeam Backup & Recovery and stems from deserialization of untrusted data, enabling remote compromise when an attacker can deliver a crafted payload to a vulnerable instance. The flaw puts backup infrastructure at particular risk because successful exploitation could give attackers direct access to systems designed to store and manage recovery data.

A separate flaw, GHSA-V6WJ-C83F-V46X, impacts the domain_lookup module in @profullstack/mcp-server and is described as an OS command injection vulnerability with a CVSS 9.8 rating. Exploitation allows attackers to execute commands with the privileges of the Node.js process, exposing source code, configuration files, environment variables, database credentials, and cryptographic keys, while also enabling persistence, malware deployment, service termination, and broader lateral movement. Together, the disclosures highlight continued risk from internet-exposed enterprise software and developer tooling that process untrusted input without adequate safeguards.