# Veeam RCE flaw threatens domain-joined backup servers

Published: 2026-06-09 · Severity: medium · Sectors: financial-services, technology
Canonical: https://vorant.io/reports/7ed73b69-17a1-4092-b9a9-a5e3056736eb/veeam-rce-flaw-threatens-domain-joined-backup-servers

> Veeam patched CVE-2026-44963, a critical RCE flaw exploitable by low-privilege domain users against Backup & Replication servers joined to Windows domains.

Veeam has released security updates addressing CVE-2026-44963, a critical remote code execution vulnerability in Backup & Replication 12.3.2.4465 and earlier version 12 builds. The flaw, discovered by WatchTowr researcher Sina Kheirkhah, allows authenticated domain users with low privileges to execute arbitrary code on domain-joined Veeam Backup servers. Version 12.3.2.4854 contains the fix, while version 13.x builds are unaffected due to architectural changes.

The vulnerability only impacts Veeam installations joined to a Windows domain, a configuration that contradicts Veeam's documented best practices but remains common among enterprises. While no active exploitation has been reported, Veeam warns that threat actors typically reverse-engineer patches to develop exploits targeting unpatched systems. The company emphasizes immediate patching given the software's widespread deployment across 550,000 customers globally.

Veeam backup infrastructure remains a priority target for ransomware operations. CISA has previously flagged four separate VBR vulnerabilities as actively exploited, including CVE-2024-40711 which was weaponized by Akira, Fog, and Frag ransomware groups in 2024. FIN7 and the Cuba ransomware gang have also historically targeted Veeam flaws to steal data, enable lateral movement, and destroy backups to prevent victim recovery.

## Mentioned in this report

- Vulnerabilities: CVE-2024-40711 (KEV), CVE-2026-44963
- Threat actors: Akira, Cuba, FIN7, Fog, Frag
- Malware: Akira, Cuba, Fog, Frag

## Detection guidance (public sample)

### Veeam Backup Service Spawning Suspicious Child Process (Possible CVE-2026-44963 Exploitation)

ATT&CK: T1190

Detects Veeam Backup & Replication service processes spawning command interpreters or scripting engines, consistent with exploitation of the domain-authenticated RCE flaw in VBR 12.x. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Veeam Backup Service Spawning Suspicious Child Process
id: 7ec1516f-583f-5ea3-b3bb-4e8e1ec0e161
status: experimental
description: Detects Veeam Backup & Replication server processes (Veeam.Backup.Service.exe,
  Veeam.Backup.Manager.exe, VeeamDeploymentService.exe, VeeamHvIntegrationSvc.exe)
  spawning command interpreters, scripting hosts, or LOLBins, which is consistent
  with exploitation of a remote code execution vulnerability such as CVE-2026-44963
  against domain-joined VBR servers.
references:
- Veeam CVE-2026-44963 advisory
author: Vorant
tags:
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - Veeam.Backup.Service.exe
    - Veeam.Backup.Manager.exe
    - VeeamDeploymentService.exe
    - VeeamHvIntegrationSvc.exe
    - VeeamNFSSvc.exe
  selection_child:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
    - \\mshta.exe
    - \\rundll32.exe
    - \\regsvr32.exe
    - \\wscript.exe
    - \\cscript.exe
  filter_updates:
    CommandLine|contains:
    - VeeamUpdater
    - Veeam.Backup.Update
  condition: selection_parent and selection_child and not filter_updates
falsepositives:
- Legitimate Veeam upgrade/patch installers that briefly invoke PowerShell during
  maintenance windows
- Scheduled Veeam configuration scripts executed by administrators
level: high
```

### Shadow Copy or Backup Catalog Deletion Consistent with Recovery Inhibition

ATT&CK: T1490

Detects deletion of Volume Shadow Copies, Windows backup catalogs, or boot recovery options, a common technique used by ransomware operators after compromising Veeam backup servers to prevent victim recovery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shadow Copy or Backup Catalog Deletion Consistent with Recovery Inhibition
id: 1a339e6d-d28f-5be0-b384-2cf8fa1850f3
status: experimental
description: Detects command-line usage of vssadmin, wbadmin, wmic, or bcdedit to
  delete shadow copies, backup catalogs, or disable recovery options. Ransomware groups
  (Akira, Fog, Frag, Cuba) have used this pattern after compromising Veeam Backup
  & Replication servers to inhibit system recovery.
references:
- CISA advisories on VBR exploitation (CVE-2024-40711)
author: Vorant
tags:
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \\vssadmin.exe
    CommandLine|contains:
    - delete shadows
    - resize shadowstorage
  selection_wbadmin:
    Image|endswith: \\wbadmin.exe
    CommandLine|contains:
    - delete catalog
    - delete backup
    - delete systemstatebackup
  selection_wmic:
    Image|endswith: \\wmic.exe
    CommandLine|contains:
    - shadowcopy delete
  selection_bcdedit:
    Image|endswith: \\bcdedit.exe
    CommandLine|contains:
    - recoveryenabled no
    - ignoreallfailures
  condition: 1 of selection_*
falsepositives:
- Legitimate storage reclamation or disk cleanup scripts run by backup administrators
- Scheduled maintenance tasks that resize shadow storage on non-backup servers
level: high
```

### Domain Account Used to Create Local Accounts or Groups via Veeam Service Context

ATT&CK: T1078.002

Detects account or group manipulation commands executed under the process tree of Veeam Backup services, indicating abuse of a low-privileged domain account to escalate or persist after exploiting a domain-joined VBR server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Account Manipulation Executed via Veeam Backup Service Process Tree
id: 13166bc9-b6dc-50de-a0e3-60038c3be50b
status: experimental
description: Detects net.exe or PowerShell account/group manipulation commands (adding
  users, adding members to Administrators) spawned from Veeam Backup & Replication
  service processes. This pattern is consistent with an attacker abusing a low-privileged
  domain account to gain persistence or elevated access after exploiting a Veeam RCE
  such as CVE-2026-44963.
references:
- Veeam CVE-2026-44963 advisory
author: Vorant
tags:
- attack.t1078.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - Veeam.Backup.Service.exe
    - Veeam.Backup.Manager.exe
    - VeeamDeploymentService.exe
  selection_net:
    Image|endswith: \\net.exe
    CommandLine|contains:
    - user
    - /add
  selection_group:
    Image|endswith: \\net.exe
    CommandLine|contains:
    - localgroup
    - administrators
  condition: selection_parent and (selection_net or selection_group)
falsepositives:
- Backup administrators running scripted provisioning of local accounts through Veeam
  pre/post job scripts
- Automated deployment tooling reusing Veeam service context to manage service accounts
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.bleepingcomputer.com/news/security/new-veeam-vulnerability-exposes-backup-servers-to-rce-attacks

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7ed73b69-17a1-4092-b9a9-a5e3056736eb/veeam-rce-flaw-threatens-domain-joined-backup-servers.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup