Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code

Summary: Veeam patched a critical flaw, CVE-2026-44963, with a CVSS score of 9.4, that allows an authenticated domain user to run remote code on the Backup Server. The issue affects Veeam Backup & Replication 12.3.2.4465 and all earlier 12 builds, is fixed in 12.3.2.4854, and does not affect 13.x builds due to architectural changes; watchTowr researcher Sina Kheirkhah is credited with reporting it.
What you should know: The bar to exploit this is an authenticated domain account, not an outside attacker, and Veeam notes prior Backup & Replication vulnerabilities have been exploited by bad actors including ransomware groups - so an ordinary user credential becomes the entry point to the system that holds your backups.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-44963
Related: ⚡ Weekly Recap: Chrome 0-Day, Uni Fi Exploits, macOS Stealers, VPN Flaw and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026