CVE-2026-44963: Backup Server RCE Vulnerability

CVE-2026-44963 Overview

CVE-2026-44963 is a remote code execution (RCE) vulnerability affecting the Veeam Backup Server. An authenticated domain user can exploit the flaw to execute arbitrary code on the backup server. The weakness is classified as deserialization of untrusted data [CWE-502], which permits attacker-controlled objects to be processed during runtime.

Veeam published guidance for the issue in Veeam Knowledge Base Article KB4869. The vulnerability carries a CVSS 4.0 score of 9.4 and impacts confidentiality, integrity, and availability across the affected system and downstream components.

Critical Impact
Any authenticated domain user can achieve arbitrary code execution on the Veeam Backup Server, placing backup data and recovery operations at direct risk.

Affected Products

Veeam Backup Server (refer to vendor advisory for exact versions)
Domain-joined deployments where standard users can reach the backup service
Environments listed in Veeam KB4869

Discovery Timeline

2026-06-09 - CVE-2026-44963 published to the National Vulnerability Database
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-44963

Vulnerability Analysis

The vulnerability resides in the Veeam Backup Server's handling of serialized objects received from authenticated clients. When a domain user submits crafted data, the server reconstructs objects without sufficient validation. The deserialization path then invokes type constructors or magic methods that lead to arbitrary code execution under the privileges of the backup service.

Because the backup server typically runs with high privileges and holds credentials for production infrastructure, successful exploitation extends well beyond the host. Attackers can manipulate backup jobs, exfiltrate stored data, or stage ransomware operations against connected systems.

Root Cause

The root cause is insecure deserialization of untrusted data [CWE-502]. The application accepts serialized object streams from authenticated callers and instantiates them without enforcing an allow-list of permitted types. Gadget chains available in the application's dependencies are then used to pivot deserialization into command execution.

Attack Vector

The attack vector is network-based with low complexity and requires only low privileges (an authenticated domain account). No user interaction is needed. An attacker who already holds standard domain credentials connects to the exposed Veeam Backup Server service and sends a crafted payload to trigger object reconstruction and code execution.

No public proof-of-concept exploit has been published at the time of writing. The EPSS probability is 0.586% with a percentile of 69.5, indicating moderate near-term exploit likelihood relative to other CVEs.

No verified exploitation code is available. See the Veeam Knowledge Base Article for vendor-confirmed technical details.

Detection Methods for CVE-2026-44963

Indicators of Compromise

Unexpected child processes spawned by the Veeam Backup Service (Veeam.Backup.Service.exe), such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections from the backup server to unfamiliar external hosts
New scheduled tasks, services, or persistence artifacts created on the backup host after authenticated sessions from non-administrative accounts
Anomalous .NET serialization payloads in network captures targeting Veeam service ports

Detection Strategies

Monitor process lineage for the Veeam Backup Service and alert on shells, scripting engines, or LOLBins as child processes
Correlate domain user authentication events against the backup server with subsequent process creation events on that host
Inspect Windows Event Logs on the backup server for unusual service account activity following client connections

Monitoring Recommendations

Enable command-line auditing (Event ID 4688) and PowerShell script block logging on the backup server
Forward backup server telemetry to a centralized analytics platform for behavioral correlation
Track file integrity on Veeam binary and configuration directories for unauthorized modification

How to Mitigate CVE-2026-44963

Immediate Actions Required

Apply the fixes referenced in Veeam KB4869 on every Backup Server in the environment
Restrict network access to the Veeam Backup Server so only required administrative hosts can reach its management ports
Review and reduce the set of domain accounts able to authenticate to the backup infrastructure
Rotate credentials and service account secrets stored on the backup server after patching

Patch Information

Veeam has published remediation guidance and fixed builds in Veeam Knowledge Base Article KB4869. Administrators should consult the article for the exact fixed version that matches their deployment and apply it without delay.

Workarounds

Place the Backup Server in an isolated management network segment with strict firewall rules until patches are applied
Remove standard domain users from any group that grants logon or service access to the backup server
Enforce multi-factor authentication on accounts permitted to interact with backup infrastructure
Disable or restrict remote administrative interfaces that are not actively required

bash

# Example firewall restriction (Windows) limiting Veeam service access
# Replace <AdminSubnet> with your management network CIDR
New-NetFirewallRule -DisplayName "Restrict Veeam Backup Service" `
  -Direction Inbound `
  -Program "C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Service.exe" `
  -RemoteAddress <AdminSubnet> `
  -Action Allow