Loading story…
Multiple ransomware groups have been exploiting a critical authentication bypass in Veeam Backup & Replication, identified as CVE-2024-40711, to gain access to backup infrastructure and deploy ransomware. Reporting tied the activity to at least one newly observed ransomware operation, with attackers abusing the flaw to compromise internet-exposed Veeam servers, move deeper into victim environments, and target backup systems that are often central to recovery efforts.
The vulnerability affects domain-joined Veeam Backup & Replication servers, and successful exploitation can allow remote code execution under certain conditions. Security reporting said the bug was being used in real-world intrusions shortly after disclosure, underscoring the risk to organizations that rely on Veeam for business continuity. Defenders were urged to patch affected systems, restrict external exposure of backup management interfaces, and monitor Veeam infrastructure for signs of unauthorized access or ransomware deployment.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting indicated that exploitation of CVE-2024-40711 was not limited to a single actor and involved multiple ransomware groups. This marked an escalation from isolated activity to broader criminal adoption of the vulnerability.
Researchers reported that a newly observed ransomware group, Frag, was exploiting CVE-2024-40711 in attacks. This added attribution detail to the broader wave of ransomware activity targeting the Veeam flaw.
Threat actors started exploiting the Veeam Backup & Replication vulnerability CVE-2024-40711 to gain access to victim environments. Reporting in July indicated the bug was being used in real-world ransomware intrusions.
Veeam disclosed and released fixes for CVE-2024-40711, a critical remote code execution vulnerability affecting Backup & Replication. The flaw later became the focus of ransomware exploitation activity.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple ransomware operations have exploited a critical Veeam Backup & Replication weakness, including **`CVE-2023-27532`**, to gain unauthorized access and deploy malware in victim environments. Reporting tied the activity to **Akira**, **Fog**, and later **Frag** ransomware, with attackers abusing exposed Veeam infrastructure to retrieve credentials and move deeper into networks. Rapid7's analysis of the flaw showed it could allow access to sensitive configuration data, making Veeam servers a high-value target for follow-on compromise. Additional reporting said some intrusions also involved **compromised VPN credentials**, combining stolen remote-access accounts with exploitation of Veeam systems to establish footholds and launch ransomware. The incidents show attackers repeatedly targeting backup infrastructure not only to encrypt production systems but also to undermine recovery options, reinforcing the need to patch internet-exposed Veeam servers, restrict administrative access, and protect stored credentials tied to backup and remote-access platforms.
Jun 29, 2026
Veeam released security updates for multiple products, including **Backup & Replication**, **Service Provider Console**, **Veeam ONE**, **Agent for Linux**, and several backup plug-ins, to fix a set of critical and high-severity vulnerabilities. The most severe issue, **`CVE-2024-40711`**, is a critical unauthenticated remote code execution flaw in **Veeam Backup & Replication** with a **CVSS 9.8** rating, allowing attackers to potentially compromise backup servers without logging in. The broader patch set also addresses weaknesses that could enable credential theft, backup manipulation, MFA bypass, privilege escalation, SSRF exploitation, and additional remote code execution in other Veeam components. Security advisories urged organizations to upgrade immediately to fixed versions, warning that backup infrastructure is a high-value target and that successful exploitation could materially increase ransomware risk by giving attackers access to recovery systems.
Jul 24, 2026
Veeam has released fixes for a critical remote code execution flaw in **Veeam Backup & Replication**, tracked as `CVE-2026-44963`, affecting version `12.3.2.4465` and earlier `12.x` builds on **Windows domain-joined** servers. The vulnerability was reported by WatchTowr researcher **Sina Kheirkhah** and allows any **authenticated low-privileged domain user** to execute arbitrary code on the backup server, giving attackers a path to compromise backup infrastructure in Active Directory environments. Veeam says **version 13.x is not affected** because of architectural changes, and the issue is resolved in **Veeam Backup & Replication `12.3.2.4854`**. The flaw has not been publicly reported as exploited, but Veeam warned that attackers often reverse-engineer patches quickly to target unpatched systems. The issue carries a **CVSS v4 score of 9.4** and is especially serious because backup servers are frequent ransomware targets: compromising them can enable **data theft, lateral movement, privilege escalation, and destruction of backups**. Reporting on the disclosure also pointed to earlier Veeam-focused attacks, including abuse of `CVE-2024-40711` by **Akira, Fog, and Frag**, underscoring the need for organizations to patch immediately, review domain-joined deployments, restrict unnecessary domain user access, and closely monitor backup infrastructure.
Jul 23, 2026