Exploit for Veeam Backup & Replication for Sale

Exploit for Veeam Backup & Replication for Sale

For informational purposes only.

Vulnerability Type: RCE Vulnerable Versions: Veeam Backup & Replication 12.x (12.3.2.4465 and earlier versions of 12.x) Price: $45,000

Based on the description and the versions specified by the author, the tool is likely related to the critical CVE-2026-44963 (CVSS 9.4) vulnerability—a flaw that allows an authenticated domain user to achieve remote code execution on a Veeam Backup Server. Veeam confirms that the issue affects build 12.3.2.4465 and earlier versions of 12.x, and that it has been fixed in 12.3.2.4854. However, the author specifically excludes build 4165, even though it is officially within the range of versions affected by CVE-2026-44963.

Upon exploitation, the attacker allegedly gains an interactive remote shell with system privileges, allowing them to create a local administrator account, enable RDP, manage services, transfer files, and run applications under the SYSTEM context.

Separately mentioned is the ability to launch the Veeam Backup Management Console with system privileges, which, according to the author of the announcement, provides full control over the backup infrastructure.

The announcement also mentions a built-in multithreaded scanner capable of searching for Veeam on standard and non-standard ports by specific IP addresses, ranges, and subnets.

The exploit can allegedly be executed without writing additional files to disk or launching separate processes, directly within the context of the Veeam process. The EXE file itself is delivered in encrypted form.