Loading vulnerability…
Authenticated Deserialization RCE in Veeam Backup & Replication 12
CVE-2026-44963 is a critical deserialization-of-untrusted-data vulnerability in Veeam Backup & Replication 12 that allows a low-privileged authenticated domain user to execute arbitrary code remotely on a domain-joined Backup Server. Affected releases include version 12.3.2.4465 and all earlier version 12 builds. Exploitation occurs over the network without user interaction and requires no elevated privileges beyond standard domain credentials. The vulnerability has a CVSS v4.0 score of 9.4. Version 12.3.2.4854 fixes the issue; version 13.x is unaffected because of architectural changes.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the Backup Server, with potentially severe consequences for confidentiality, integrity, and availability. Depending on accessible resources and privileges, attackers could steal sensitive backup data, delete or encrypt backups, access stored credentials for lateral movement, and disrupt recovery operations. Full compromise of backup infrastructure can substantially impair recovery from ransomware or other destructive attacks.
If you can’t patch tonight, do this now.
Review domain membership and evaluate a workgroup deployment in accordance with Veeam hardening guidance; workgroup deployments are not affected by this specific attack vector. Review domain-user access controls and monitor backup infrastructure for suspicious code execution, lateral movement, and privilege escalation. Investigate possible prior compromise, because applying the patch does not remove an existing intrusion. These measures do not replace updating affected installations.
Patch, then assume compromise.
Upgrade affected Veeam Backup & Replication 12 installations to version 12.3.2.4854 or a later fixed release. Prioritize domain-joined Backup Servers and deploy the update promptly after appropriate testing. Version 13.x is not affected by this vulnerability.
No validated public exploits yet. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
62 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.