A newly disclosed vulnerability in Veeam Backup & Replication (VBR) poses a significant risk to organizations relying on the software for data protection. The vulnerability, tracked as CVE-2026-44963, allows for remote code execution (RCE) on domain-joined backup servers.
What Happened
Veeam released security updates to address the critical flaw, which affects VBR versions 12.3.2.4465 and all earlier 12.x builds. The vulnerability was reported by WatchTowr security researcher Sina Kheirkhah and has been addressed in version 12.3.2.4854. Crucially, the vulnerability only impacts VBR installations joined to a Windows domain. Veeam notes that version 13.x builds are not affected due to architectural changes implemented in that version.
Why It Matters
The potential for RCE is particularly concerning because Veeam backup servers are frequent targets for ransomware groups. Attackers often target these servers to steal data, move laterally within a network, and disrupt recovery efforts by deleting backups. BleepingComputer reports that ransomware gangs have specifically mentioned targeting Veeam servers in the past. The Cybersecurity and Infrastructure Security Agency (CISA) has previously flagged four VBR flaws as actively exploited, underlining the real-world risk. Given Veeam’s widespread adoption – over 550,000 customers globally, including a large percentage of Fortune 500 and Global 2,000 companies – a successful exploit could have a broad impact. While there are currently no reports of active exploitation of CVE-2026-44963, Veeam warns that attackers routinely attempt to reverse-engineer patches to develop exploits for unpatched systems.
It is important to note that Veeam has long recommended against joining backup servers to a domain, but many organizations have ignored this guidance. This practice significantly expands the attack surface. The vulnerability underscores the importance of adhering to security best practices and promptly applying security updates.
What To Watch
Organizations using Veeam Backup & Replication should immediately assess their environments and apply the available patch (version 12.3.2.4854 or later) if running a vulnerable version. Monitor Veeam’s security advisories for further updates and potential indicators of compromise. Consider evaluating the necessity of domain-joining backup servers and explore alternative configurations aligned with Veeam’s recommendations. The rapid weaponization of previous Veeam vulnerabilities suggests a short window of opportunity for attackers, so swift action is critical.