Veeam Backup and Replication Deserialization Vulnerability (CVE-2024-40711)

What is affected, what to do

A deserialization vulnerability in Veeam Backup and Replication allows an unauthenticated attacker to perform remote code execution (RCE). This affects versions 12.0.0.1420 to 12.2.0.334 and is actively exploited in ransomware campaigns since October 2024. Immediate patching to the latest version is critical to mitigate this risk.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update veeam_backup_\&_replication to version 12.2.0.334. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Veeam Backup and Recovery lte 12.1.2..12.1.2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Patch: Upgrade every Veeam Backup & Replication 12.x server to build 12.2.0.334 or later. Check the Veeam Security Bulletin for the latest fixed build and KB reference. The affected range per context is 12.0.0.1420 through 12.2.0.334. Verify the installed build via "Help > About" in the console or the file version of Veeam.Backup.Service.exe.
   • Inventory: Enumerate all VBR servers, console installs and proxies, including forgotten branch-office or MSP-managed instances. Tag any unpatched host as critical.
   • Restrict network access: Until patched, allow inbound connections to the VBR server only from the backup management network. Public research describes exploitation via the Mount Service on TCP 8000. Restrict that port and the other Veeam service ports to known proxy and repository IPs using the host firewall. Make sure the VPN user pool cannot reach the server.
   • Compromise check: On unpatched hosts, hunt for newly created local accounts and unexpected members of the local "Administrators" and "Remote Desktop Users" groups. If you find any, isolate the host and trigger your NIS2 incident process (early warning within 24 h).
   • Rotate credentials: If compromise is suspected, rotate every credential stored in the Veeam configuration database. This covers vCenter/ESXi, Hyper-V, domain accounts, repository, cloud and SQL accounts.
   • Harden VPN access: Enforce MFA on all remote access immediately. Compromised VPN accounts without MFA were a common initial access path to reach the VBR server.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place the VBR server in a dedicated management VLAN. Apply default-deny from clients, VPN pools and the internet. Allow egress only to defined destinations: hypervisors, repositories and the Veeam update servers.
   • IPS/NDR: Alert on connections to TCP 8000 and other Veeam service ports from anything other than known Veeam components. Also look for .NET remoting / BinaryFormatter payloads aimed at the VBR server where your IPS vendor ships CVE-2024-40711 signatures.
   • IAM: Following Veeam best practice, keep the VBR server out of the production domain and use a separate management domain or workgroup. Run service accounts with least privilege and enable MFA for console logons.
   • Backup resilience: Use immutable backups, such as a Hardened Linux Repository, S3 Object Lock or an offline copy following the 3-2-1-1-0 rule. This keeps recovery data safe even if the VBR server falls. Review your immutability windows.
   • Endpoint hardening: Use EDR or ASR rules to stop Veeam service processes from launching cmd.exe, powershell.exe, net.exe or net1.exe. Validate in audit mode first.
3. 03

   Runbook step 3

   Detection rules

   • Process ancestry (Sysmon EID 1 / EDR): A Veeam service spawns a shell or admin tool. Sigma shape: ParentImage|endswith: '\Veeam.Backup.MountService.exe' AND Image|endswith: ['\cmd.exe','\powershell.exe','\net.exe','\net1.exe'].
   • Account creation (Windows Security log): Event ID 4720 (user created) followed by 4732 (added to a local group such as Administrators or Remote Desktop Users) on the VBR host. KQL: SecurityEvent | where Computer has "vbr" and EventID in (4720,4732).
   • Lateral movement: Event ID 4624 with LogonType 10 (RDP) or 3 from newly created accounts on the VBR server. Logons shortly after a non-MFA VPN session are also suspicious.
   • Network telemetry (Zeek/Suricata): Review conn.log for inbound connections to id.resp_p == 8000 on the VBR server from sources that are not proxies or repositories. SPL: index=zeek dest_ip=<VBR> dest_port=8000 NOT src_ip IN (<veeam_components>).
   • Credential theft: Watch for non-Veeam processes accessing the Veeam configuration database (SQL/PostgreSQL). Execution of sqlcmd.exe or PowerShell scripts matching Veeam credential-dump patterns is also a red flag.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Veeam Backup And Recovery
• Veeam Veeam Backup \& Replication

References & sources

• veeam.comVeeam advisory: CVE-2024-40711Vendor advisory, pwn-watch
• labs.watchtowr.comveeam-backup-response-rce-with-auth-but-mostly-without-auth-cve…Exploit, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40711government-resource, US government resource
• pwn.watchpwn.watch: Veeam Backup and Replication Deserializationpwn-watch
• NVD (NIST)NVD: CVE-2024-40711pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch