CVE-2024-40717: Veeam Backup & Replication RCE Vulnerability

CVE-2024-40717 Overview

CVE-2024-40717 is a high-severity remote code execution (RCE) vulnerability in Veeam Backup & Replication. The flaw allows a low-privileged authenticated user with certain assigned roles to update existing backup jobs and abuse their pre- and post-script functionality. These scripts can reference a network share and execute with elevated privileges by default. An attacker can schedule the modified job to run almost immediately, achieving arbitrary code execution on the Veeam server. The vulnerability is tracked under CWE-306: Missing Authentication for Critical Function.

Critical Impact
A low-privileged authenticated user can achieve remote code execution on the Veeam Backup & Replication server with elevated privileges by modifying job scripts.

Affected Products

Veeam Backup & Replication (all versions prior to the vendor-issued fix)
Veeam-managed backup infrastructure with role-based access for job editing
Environments where pre-/post-script execution is enabled on backup jobs

Discovery Timeline

2024-12-04 - CVE-2024-40717 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-40717

Vulnerability Analysis

CVE-2024-40717 stems from insufficient authorization enforcement around job configuration in Veeam Backup & Replication. Backup jobs support optional pre-job and post-job scripts intended for administrator-defined automation. The product allows script paths to point to network shares and executes those scripts with elevated service privileges by default.

An authenticated user holding a lower-privileged role, such as one that permits editing existing jobs, can repurpose this legitimate feature into a code execution primitive. The attacker updates a job to reference an attacker-controlled binary or script, sets the schedule to run almost immediately, and waits for the Veeam service to execute the payload under privileged context. The attack requires network access to the Veeam application and valid credentials, but no user interaction on the target.

Root Cause

The root cause is missing authentication and authorization checks around a sensitive function ([CWE-306]). The product treats job-update permission as sufficient authority to define code that will execute on the backup server, without enforcing a separate, stronger privilege check on script content or script paths. The default elevated execution context for pre- and post-scripts amplifies the impact.

Attack Vector

The attack is network-based and requires authenticated access as a low-privileged user with a role that permits job modification. The attacker performs the following high-level steps:

Authenticate to the Veeam Backup & Replication server using valid low-privileged credentials.
Stage a malicious executable or script on a reachable network share.
Modify an existing backup job's pre- or post-script setting to point at the staged payload.
Adjust the job schedule so it triggers almost immediately.
The Veeam service executes the payload with elevated privileges, yielding RCE on the backup server.

No verified public proof-of-concept code is currently referenced in the CVE record. Refer to the Veeam Knowledge Base Article KB4693 for vendor technical details.

Detection Methods for CVE-2024-40717

Indicators of Compromise

Unexpected modifications to backup job configurations, particularly changes to pre- or post-script paths pointing to network shares or unusual file system locations.
Job schedule changes that set a job to run immediately or at short intervals shortly after a configuration edit.
Child processes spawned by the Veeam Backup service (Veeam.Backup.Manager.exe, Veeam.Backup.Service.exe) that launch cmd.exe, powershell.exe, or arbitrary binaries.
Outbound network connections or SMB reads from the Veeam server to attacker-controlled shares immediately preceding script execution.

Detection Strategies

Audit Veeam job configuration changes and correlate the identity performing the edit with the roles assigned to that account.
Monitor process creation events on the Veeam Backup server for descendant processes of Veeam service binaries that are not part of normal backup operations.
Alert on backup jobs whose script fields reference UNC paths (\\host\share\...) or writable directories outside standard administrator locations.

Monitoring Recommendations

Enable and forward Veeam audit and job-history logs to a central SIEM for review.
Track authentication events against the Veeam console, especially interactive edits performed by non-administrator roles.
Baseline the set of legitimate pre-/post-scripts in the environment and alert on any deviation.

How to Mitigate CVE-2024-40717

Immediate Actions Required

Apply the Veeam Backup & Replication update referenced in Veeam KB4693 as soon as practical.
Review all user accounts and roles on the Veeam server and remove job-edit permissions from accounts that do not require them.
Audit existing backup jobs for pre- and post-script entries and validate each script path against a known-good inventory.
Rotate credentials for any low-privileged Veeam accounts suspected of misuse.

Patch Information

Veeam has published fix guidance in Knowledge Base Article KB4693. Administrators should upgrade Veeam Backup & Replication to the fixed version identified in the advisory and validate that the pre-/post-script authorization behavior has been remediated after upgrade.

Workarounds

Restrict Veeam console access to trusted administrators and remove roles that permit job editing from general operator accounts until patching is complete.
Disable pre- and post-script execution on backup jobs where the functionality is not required.
Block or tightly control access from the Veeam server to network shares that are not part of legitimate backup workflows.
Segment the Veeam Backup & Replication server on a management network with strict inbound access controls.

bash

# Configuration example
# Review role assignments in Veeam and remove job-edit rights from non-admin users.
# From the Veeam Console: Users and Roles > select user > verify role is 'Restore Operator'
# or a read-only equivalent rather than 'Backup Operator' or 'Backup Administrator'.

# On the Veeam server, audit recent job configuration changes:
Get-WinEvent -LogName 'Veeam Backup' |
  Where-Object { $_.Message -match 'job.*(updated|modified|script)' } |
  Select-Object TimeCreated, Id, Message