CVE-2024-40711

What it actually does

This is an unauthenticated remote code execution vulnerability caused by unsafe deserialization of attacker-controlled data in Veeam Backup & Replication. A remote attacker who can reach the vulnerable service can send a crafted serialized payload that is processed by the application and results in arbitrary code execution, typically in the security context of the Veeam service account or local system-level service process. Because backup servers commonly hold privileged credentials, backup repositories, restore capabilities, and access to production systems, successful exploitation can quickly become full infrastructure compromise.

Why it matters to the business

Compromise of a backup platform can directly affect an organization’s ability to recover from outages, ransomware, or destructive attacks. Attackers may delete or encrypt backups, steal stored credentials, pivot into protected workloads, disable recovery operations, and deploy ransomware across the environment. This issue is listed in CISA KEV, has been used in ransomware campaigns, has active in-the-wild exploitation, and has a high EPSS score, so internet-exposed or broadly reachable Veeam Backup & Replication servers should be treated as urgent remediation priorities. CISA’s KEV remediation due date was 2024-11-07.

How an attack unfolds

An attacker first identifies a reachable Veeam Backup & Replication service, commonly through external scanning, exposed management interfaces, or lateral movement inside a network. The attacker then sends a malicious serialized payload to the vulnerable service. When the application deserializes that payload, attacker-controlled code executes without requiring authentication. After gaining code execution, the attacker may run commands through the Veeam service process, create local administrator accounts, install remote access tooling, dump or reuse credentials stored on the backup server, enumerate backup jobs and repositories, disable or delete backups, and then move laterally to virtualization platforms, Windows servers, or domain resources. In ransomware intrusions, the backup server is often targeted early to weaken recovery options before encryption or extortion activity begins.

How to fix it

Upgrade Veeam Backup & Replication to a vendor-supported fixed release immediately. Where version-specific package data is not available in the input, use the latest Veeam security update for the deployed major version; for Veeam Backup & Replication 12.x, organizations should verify they are on a patched 12.2 or later build such as 12.2.0.334 or newer, according to current vendor guidance. Restrict access to Veeam management and service ports to dedicated administrative networks only; do not expose Veeam Backup & Replication services directly to the internet. Segment backup infrastructure from general user and server networks. Review and rotate credentials stored in Veeam after patching, especially domain, hypervisor, storage, cloud, and repository credentials. Enable MFA for administrative access where supported. Harden backup repositories with immutability, separate administrative accounts, and least-privilege access. If compromise is suspected, preserve forensic evidence before rebuilding or restoring the backup server.

How to confirm the fix worked

Confirm the installed Veeam Backup & Replication build from the Veeam console, Windows installed applications inventory, or executable file version information, and compare it against the latest vendor advisory. Validate that the server is no longer running a vulnerable build and that all Veeam components, consoles, proxies, and repositories have been updated where applicable. From a network perspective, verify that Veeam service and management ports are reachable only from authorized administrative hosts and not from the internet or broad internal subnets. Run authenticated vulnerability scans after patching. Review Veeam logs and Windows event logs for signs of exploitation before declaring remediation complete, because patching does not remove attacker-created accounts, malware, scheduled tasks, stolen credentials, or modified backup jobs.

Typical attack path

1. Scan for or discover a reachable Veeam Backup & Replication server or service port.
2. Confirm the target is running a vulnerable Veeam Backup & Replication build.
3. Send a crafted serialized payload to the vulnerable service endpoint.
4. Achieve unauthenticated code execution in the context of the Veeam service process.
5. Execute operating system commands, stage tooling, or create a persistent local account.
6. Harvest credentials or tokens available to the backup platform.
7. Enumerate backup jobs, repositories, restore points, and connected infrastructure.
8. Disable jobs, delete or corrupt backups, or remove immutable recovery options where possible.
9. Pivot to connected Windows, virtualization, storage, or domain resources.
10. Deploy ransomware, exfiltrate data, or use the compromised backup server for continued persistence.

How to detect it

Investigate Veeam Backup & Replication servers for evidence of suspicious inbound connections followed by unexpected process execution, account creation, service creation, backup deletion, or credential access. Review Veeam application logs under the Veeam log directory, especially service logs, for errors, unexpected serialized request handling failures, abnormal remote sessions, or service crashes/restarts near suspicious network activity. Review Windows Security logs for new local users, group membership changes, privileged logons, and unusual authentication sources. Relevant Windows events include 4624 for logons, 4625 for failed logons, 4672 for special privileges assigned, 4688 for process creation if enabled, 4720 for user account creation, 4722 for account enablement, 4728/4732 for group membership changes, 4697 for service installation, and 7045 in the System log for new service creation. Review PowerShell logs, Sysmon telemetry, EDR alerts, scheduled tasks, autoruns, and network telemetry for commands or tools launched by Veeam service processes. Look for Veeam service processes spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, net.exe, net1.exe, nltest.exe, whoami.exe, ipconfig.exe, taskkill.exe, vssadmin.exe, wbadmin.exe, bcdedit.exe, or ransomware-related tooling. Also review Veeam job history for unauthorized deletion, disabling, repository changes, retention changes, failed backup chains, or unexpected restore point removal. Because this vulnerability has been associated with ransomware campaigns, treat any suspicious administrative action on the backup server as high severity.

• Veeam.Backup.Service.exe
• Veeam Backup Service
• C:\ProgramData\Veeam\Backup\Svc.VeeamBackup.log
• C:\ProgramData\Veeam\Backup\
• TCP/9401
• Event ID 4720
• Event ID 4732
• Event ID 7045
• Event ID 4697
• Event ID 4688
• cmd.exe spawned by Veeam.Backup.Service.exe
• powershell.exe spawned by Veeam.Backup.Service.exe
• net.exe spawned by Veeam.Backup.Service.exe
• net1.exe spawned by Veeam.Backup.Service.exe
• rundll32.exe spawned by Veeam.Backup.Service.exe
• regsvr32.exe spawned by Veeam.Backup.Service.exe
• certutil.exe spawned by Veeam.Backup.Service.exe
• bitsadmin.exe spawned by Veeam.Backup.Service.exe
• vssadmin.exe spawned by Veeam.Backup.Service.exe
• wbadmin.exe spawned by Veeam.Backup.Service.exe
• bcdedit.exe spawned by Veeam.Backup.Service.exe

What your security team should do

• Immediately identify all Veeam Backup & Replication servers and prioritize any internet-exposed or broadly reachable systems.
• Patch or upgrade Veeam Backup & Replication to the latest fixed vendor-supported build; treat this as emergency work because exploitation is active and ransomware-related.
• If the service was exposed before patching, perform compromise assessment rather than assuming the upgrade is sufficient.
• Restrict Veeam service access with firewalls, VPN, administrative jump hosts, and network segmentation.
• Review Windows local users and administrators on Veeam servers for unauthorized accounts created around the exposure window.
• Rotate credentials stored in or used by Veeam, including domain, hypervisor, storage, repository, cloud, and service credentials.
• Review Veeam backup jobs, repositories, retention settings, immutability settings, and restore points for unauthorized deletion or tampering.
• Search for suspicious process execution spawned by Veeam service processes, especially command shells, PowerShell, remote access tools, credential dumping tools, and ransomware staging activity.
• Ensure immutable or offline backup copies exist and test restoration from known-good restore points.
• Increase monitoring on backup servers because they are high-value post-exploitation targets in ransomware operations.