Critical RCE in Veeam Backup & Replication Exposes Domain-Joined Servers

Veeam has released fixes for a critical remote code execution flaw in Veeam Backup & Replication, tracked as CVE-2026-44963, affecting version 12.3.2.4465 and earlier 12.x builds on Windows domain-joined servers. The vulnerability was reported by WatchTowr researcher Sina Kheirkhah and allows any authenticated low-privileged domain user to execute arbitrary code on the backup server, giving attackers a path to compromise backup infrastructure in Active Directory environments. Veeam says version 13.x is not affected because of architectural changes, and the issue is resolved in Veeam Backup & Replication 12.3.2.4854.

The flaw has not been publicly reported as exploited, but Veeam warned that attackers often reverse-engineer patches quickly to target unpatched systems. The issue carries a CVSS v4 score of 9.4 and is especially serious because backup servers are frequent ransomware targets: compromising them can enable data theft, lateral movement, privilege escalation, and destruction of backups. Reporting on the disclosure also pointed to earlier Veeam-focused attacks, including abuse of CVE-2024-40711 by Akira, Fog, and Frag, underscoring the need for organizations to patch immediately, review domain-joined deployments, restrict unnecessary domain user access, and closely monitor backup infrastructure.