CVE-2026-44963: A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user

Synopsis

A remote code execution vulnerability affects Veeam Backup and Replication versions prior to 12.3.2. The flaw is reachable over the network and requires only a low-privilege domain user account to exploit, with no user interaction needed. Successful exploitation gives an attacker full code execution on the Backup Server, along with high-impact compromise of confidentiality, integrity, and availability across both the local system and connected scopes. A patched-image rebuild at version 12.3.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Backup Server over the network; the service must be accessible from the attacker's position.

• AuthenticationRequired

  A low-privilege domain user account is sufficient; no administrative or elevated permissions are required.

• Victim interactionNot required

  No victim action is needed; the attacker can trigger the vulnerability without any user involvement.

• Attack complexityDetail

  Exploit complexity is low, with no special conditions, race windows, or environmental factors required for reliable execution.

Blast Radius

• Executes arbitrary code on the Backup Server host, giving the attacker a full shell or process under the server's execution context.
• Reads backup data, credentials, and configuration stored on or accessible from the Backup Server.
• Modifies or deletes backup jobs, backup data, and server configuration, potentially destroying recovery points.
• Disrupts backup and replication services, preventing recovery operations and affecting downstream systems connected to the Backup Server.