{"id":"CVE-2026-44963","published":"2026-06-09T22:27:01Z","modified":"2026-06-10T10:04:13Z","title":"A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user","vendor":"Veeam","product":"Backup and Replication","tier":"core","eol":null,"affectedVersions":[{"vendor":"Veeam","product":"Backup and Replication","versions":["< 12.3.2"]}],"description":{"text":"A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.","provenance":"source","from":"CVE.org"},"summary":{"text":"Veeam Backup and Replication contains a deserialization of untrusted data flaw in its Backup Server, which permits remote code execution on that host. An attacker needs only a valid domain user account, requires no user interaction, and can reach the server over the network.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:02Z"},"cvss":{"score":9.4,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02351,"percentile":0.83692,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-07-10","exploitedFirstSeen":"2026-07-10","ransomware":false,"evidence":[{"url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape","date":"2026-07-10"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":4,"pulses":[{"name":"VEEAM UNDER FIRE: Understanding CVE-2026–44963 Ransomware Group Exploit Claims: THE RAVEN FILE","url":"https://otx.alienvault.com/pulse/6a8b057a1643832d72de493b","created":"2026-08-23"},{"name":"Known_Cve | Jun 18, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a32abfd6fc11b7a571269c2","created":"2026-06-17"},{"name":"Known_Cve | Jun 17, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a315a8c1b915c8950938b56","created":"2026-06-16"},{"name":"Known_Cve | Jun 11, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6a297435a099bbb02c3e6792","created":"2026-06-10"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://www.veeam.com/kb4869","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-35868","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-35868","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2026-06-10","earliestUrl":"https://github.com/HORKimhab/CVE-2026-44963","repos":[{"name":"jockerjml/CVE-2026-44963-veeam-checker","url":"https://github.com/jockerjml/CVE-2026-44963-veeam-checker","stars":1,"created":"2026-06-18"},{"name":"HORKimhab/CVE-2026-44963","url":"https://github.com/HORKimhab/CVE-2026-44963","stars":0,"created":"2026-06-10"}]},"first":{"date":"2026-06-10","source":"PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2026-44963"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-06-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-44963","provenance":"source"},{"date":"2026-06-10","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2026-44963","provenance":"source"},{"date":"2026-07-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 113 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.74,"detail":"percentile 0.8369"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":6.58,"detail":"base score 9.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}