Actively exploited in the wild
Veeam Backup and Replication Deserialization Vulnerability
Veeam - Backup & Replication · Listed in the CISA KEV since 2024-10-17. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-40711
CriticalCVSS 9.8KEVSummary
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
Risk Assessment
It enables an unauthenticated attacker to execute arbitrary code remotely, potentially leading to full system compromise and data confidentiality breaches.
Recommendation
Immediately apply the available security patches and consider restricting network access to the vulnerable component.
Other vulnerabilities in Veeam Backup & Replication
See all- CVE-2026-21672High
A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.
- CVE-2026-21671Critical
The vulnerability allows an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.
- CVE-2022-26501CriticalActively exploited
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
Original NVD description (English source)
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).