CVE-2024-40711

The vulnerability results from unsafe deserialization of untrusted data (CWE-502). An attacker sends a specially crafted payload over the network, which is deserialized by the application without prior authentication. The process of deserializing malicious data leads to the execution of arbitrary code in the context of the application.

An attacker without any credentials can remotely execute arbitrary code on the server, which in practice means complete takeover of the system, including the ability to steal data, install backdoors, and conduct further lateral movement in the network.

Patches available from the vendor must be applied immediately in accordance with the official Veeam support article (kb4649). Due to active exploitation of the vulnerability, the update should be performed without delay.

Veeam Backup & Replication — versions indicated in the vendor's references (see: veeam.com/kb4649)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.