A critical security vulnerability in Veeam Backup & Replication has been disclosed, enabling authenticated domain users to execute remote code on backup servers.
Tracked as CVE-2026-44963, the flaw carries a CVSS v4 score of 9.4, placing it firmly in the critical severity category and demanding immediate attention from enterprise security teams.
The vulnerability was reported by Sina Kheirkhah (@SinSinology) of WatchTowr and publicly disclosed on June 9, 2026.
Critical Veeam Vulnerability
It affects Veeam Backup & Replication versions 12 through 12.3.2.4465 and all earlier 12 builds, spanning several major releases widely deployed across enterprise environments.
Critically, the flaw only impacts domain-joined backup servers. An authenticated domain user, not necessarily a privileged administrator, can exploit this vulnerability to achieve remote code execution (RCE) directly on the backup server.
This attack vector is particularly dangerous because domain user accounts are broadly available across organizations, significantly lowering the barrier for exploitation in Active Directory environments, Veeam said.
Unsupported versions of the product were not formally tested, are presumed vulnerable, and should be treated as such.
Backup servers are high-value targets in ransomware and destructive attack campaigns. Threat actors routinely pursue backup infrastructure to eliminate recovery options before deploying ransomware payloads, maximizing leverage against victims.
An RCE vulnerability on a Veeam backup server can give attackers a foothold, rendering an organization’s entire disaster recovery strategy useless.
The combination of a critical CVSS score, a low authentication barrier, and the strategic importance of backup servers makes CVE-2026-44963 a prime candidate for rapid weaponization.
Veeam itself acknowledged this risk in its advisory, warning that once a patch is publicly disclosed, threat actors typically reverse-engineer it to develop exploits targeting unpatched deployments.
Affected Versions
The following Veeam Backup & Replication versions are confirmed affected:
- Version 12
- Version 12.1
- Version 12.2
- Version 12.3
- Version 12.3.1
- Version 12.3.2 (build 12.3.2.4465 and earlier)
Notably, version 13.x is not affected due to architectural changes introduced in that release line, offering a degree of protection for organizations that have already migrated to the newer major version.
Patch and Mitigation
Veeam resolved this vulnerability in Veeam Backup & Replication 12.3.2.4854, released alongside the advisory. All users running version 12.x should upgrade to this build immediately.
For organizations unable to patch immediately, Veeam’s Security Best Practice Guide recommends deploying backup servers in workgroup mode rather than domain-joined configurations, which directly mitigates this specific vulnerability.
Isolating backup infrastructure from the broader Active Directory environment reduces the attack surface considerably until patching is complete.
Security teams should prioritize the following actions:
- Upgrade immediately to Veeam Backup & Replication 12.3.2.4854
- Audit domain-joined backup servers across the environment and assess exposure
- Monitor for exploitation attempts targeting Veeam services, particularly unusual authenticated activity
- Review backup server network segmentation to limit lateral movement opportunities
Given Veeam’s widespread enterprise adoption and the critical nature of backup infrastructure, organizations should treat this vulnerability as high-priority remediation regardless of current threat detection posture.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
