CVE-2024-39718: Veeam Backup & Replication RCE Flaw

CVE-2024-39718 Overview

CVE-2024-39718 is an improper input validation vulnerability in Veeam Backup & Replication. The flaw allows a low-privileged authenticated user to remotely remove files on the system with permissions equivalent to the service account. Veeam disclosed the issue in its September 2024 security bulletin and published guidance in Veeam Knowledge Base Article KB4649.

Critical Impact
An authenticated network-based attacker can delete arbitrary files with service-account privileges, undermining the integrity of backup data and enabling denial of service against production recovery infrastructure.

Affected Products

Veeam Backup & Replication (versions prior to the September 2024 patched release)
Deployments exposing the Veeam service to authenticated low-privilege users
Environments where the Veeam service account holds broad file system permissions

Discovery Timeline

2024-09-07 - CVE-2024-39718 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39718

Vulnerability Analysis

The vulnerability stems from improper input validation within a Veeam Backup & Replication network-accessible interface. A low-privileged authenticated user can supply crafted input that the service processes without sufficient sanitization. The service then acts on the input to remove files from the host, using the privileges of the account running the Veeam service.

Because backup service accounts typically hold elevated file system permissions across the backup infrastructure, the practical impact extends beyond the Veeam installation directory. An attacker can target configuration files, backup catalog data, logs, or supporting binaries. Loss of these files disrupts backup operations and can compromise recovery point objectives.

The CVSS vector reflects network attack surface with low attacker privileges and no user interaction. Confidentiality is not affected, but both integrity and availability are impacted at a high level because file deletion damages stored data and can render the service inoperable.

Root Cause

The root cause is missing or insufficient validation of user-supplied input on a file operation code path. The service accepts identifiers or paths from an authenticated remote caller and passes them to a delete operation without enforcing constraints on which files the caller is allowed to touch. The CWE is recorded as NVD-CWE-noinfo because Veeam has not published a specific weakness classification.

Attack Vector

Exploitation requires network reachability to the Veeam Backup & Replication service and valid credentials for any account, including low-privileged users. The attacker issues a crafted request that triggers the vulnerable file deletion routine. No user interaction is required. Veeam has not published exploitation details, and no public proof-of-concept is available as of this writing.

The vulnerability manifests in an input handling routine within the Veeam service. See the Veeam Knowledge Base Article KB4649 for vendor-provided technical details.

Detection Methods for CVE-2024-39718

Indicators of Compromise

Unexpected deletion of files under Veeam installation, configuration, or backup repository directories
Veeam service errors referencing missing configuration files, catalogs, or logs after normal operations
Authentication events from low-privileged accounts followed by file system change events on the Veeam server
Gaps or truncation in Veeam job logs that do not align with scheduled maintenance windows

Detection Strategies

Correlate authenticated sessions to the Veeam service with subsequent file deletion events on the host
Baseline normal file deletion patterns on Veeam servers and alert on deviations, especially outside maintenance windows
Review Veeam audit logs for API or console operations invoked by non-administrative accounts
Monitor for 4660 and 4663 Windows Security events on Veeam directories where the process is the Veeam service

Monitoring Recommendations

Forward Veeam server security, application, and Veeam-specific logs to a centralized SIEM for retention and correlation
Alert on failed backup jobs that follow suspicious authentication events from low-privileged users
Track integrity of the Veeam configuration database and repository metadata using file integrity monitoring
Enable and review Veeam role-based access control (RBAC) audit trails on a recurring cadence

How to Mitigate CVE-2024-39718

Immediate Actions Required

Apply the Veeam Backup & Replication update referenced in Veeam KB4649 as the primary remediation
Inventory all Veeam Backup & Replication instances and confirm each is running a patched build
Audit Veeam user accounts and remove or downgrade unnecessary low-privilege access to the service
Restrict network access to the Veeam Backup & Replication management interfaces to trusted administrative networks

Patch Information

Veeam released a fixed build of Veeam Backup & Replication that addresses CVE-2024-39718. Refer to Veeam Knowledge Base Article KB4649 for the specific fixed version, upgrade path, and any prerequisites. Administrators should test the update in a staging environment and then upgrade production instances promptly.

Workarounds

Enforce network segmentation so only authorized administrators can reach the Veeam Backup & Replication service ports
Remove interactive and API access for any Veeam role that does not require it, following least privilege
Run the Veeam service under an account scoped only to required paths, reducing the blast radius of arbitrary file deletion
Maintain immutable or air-gapped backup copies so that deletion on the primary Veeam server does not destroy last-resort recovery data

bash

# Configuration example: restrict inbound access to the Veeam server
# using Windows Firewall (adjust ports and source ranges to your environment)
New-NetFirewallRule -DisplayName "Veeam-Admin-Only" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 9392,9401,9419 `
  -RemoteAddress 10.0.10.0/24 `
  -Action Allow