CVE-2026-44963

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication versions prior to 12.3.2.4854

Description A critical flaw in the deserialization mechanism allows an authenticated domain user with low privileges to execute arbitrary code remotely on the Backup Server. This issue specifically impacts domain-joined installations, while workgroup deployments remain unaffected. Successful exploitation can lead to a full compromise of the backup infrastructure, potentially granting the attacker NT AUTHORITYSYSTEM privileges. Deserialization is the process of taking data from a format like JSON or XML and converting it back into an object that a program can use; a flaw here allows attackers to inject malicious objects that the system executes.

Recommendations Update Veeam Backup & Replication to version 12.3.2.4854. As a defense-in-depth measure, avoid joining backup servers to a Windows domain.