Veeam Backup RCE flaw affects pre-12.3.2 versions

9 June 2026 critical vulnerability

A remote code execution vulnerability in Veeam Backup & Replication versions before 12.3.2.4854 allows attackers to execute arbitrary code remotely.

The French cybersecurity agency CERT-FR has published an advisory warning of a remote code execution vulnerability in Veeam Backup & Replication. The flaw, tracked as CVE-2026-44963, affects all versions prior to 12.3.2.4854 and enables an attacker to execute arbitrary code on vulnerable systems.

Veeam Backup & Replication is widely deployed enterprise backup software used to protect virtual, physical, and cloud-based workloads. Given its privileged position in IT infrastructure and access to sensitive backup data, exploitation of this vulnerability could have severe consequences including data theft, ransomware deployment, or complete infrastructure compromise.

Veeam has released version 12.3.2.4854 to address the vulnerability. Organizations running affected versions should prioritize patching, as backup infrastructure is a high-value target for threat actors seeking to disrupt recovery capabilities during ransomware attacks.

Mentioned in this report

Vulnerabilities CVE-2026-44963

Detection guidance

Suspicious Child Process Spawned by Veeam Backup Service

ATT&CK T1210

Detects Veeam Backup & Replication service processes spawning command interpreters or scripting engines, consistent with exploitation of RCE vulnerabilities such as CVE-2026-44963. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned by Veeam Backup Service
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \Veeam\
    ParentImage|endswith:
    - Veeam.Backup.Service.exe
    - Veeam.Backup.Manager.exe
    - VeeamDeploymentSvc.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \cscript.exe
    - \wscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts triggered by scheduled Veeam maintenance jobs
- Backup pre/post job scripts configured by administrators to run PowerShell or cmd
level: high
tags:
- attack.t1210
- attack.execution
- cve.2026-44963
id: 799596e5-cbc3-5b77-bd9d-5480832ebb69
status: experimental
author: Vorant

Veeam Backup Service Spawning Network Utility or Web Shell Indicators

ATT&CK T1505.003

Detects Veeam backup server processes spawning network reconnaissance or web-shell-like utilities, a pattern seen after exploitation of Veeam RCE vulnerabilities to establish persistence or lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Veeam Backup Service Spawning Network or Recon Utility
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \Veeam\
  selection_child:
    Image|endswith:
    - \certutil.exe
    - \bitsadmin.exe
    - \net.exe
    - \net1.exe
    - \whoami.exe
    - \nltest.exe
    - \systeminfo.exe
  condition: selection_parent and selection_child
falsepositives:
- Veeam health checks or license validation scripts using net or systeminfo commands
- Administrative diagnostic scripts invoked from the Veeam console
level: medium
tags:
- attack.t1505.003
- attack.discovery
- cve.2026-44963
id: 767d3acb-36a3-555f-8cb4-e941cc32c51c
status: experimental
author: Vorant

Veeam Backup Service Process Crash or Unexpected Restart Preceding New Process Tree

ATT&CK T1210

Detects an unexpected new process image being loaded under the Veeam Backup service account context shortly after a service restart, which may indicate exploitation of an RCE flaw causing the service to spawn attacker-controlled code. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unexpected Process Under Veeam Service Account Context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    User|contains: Veeam
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \rundll32.exe
  filter:
    Image|endswith:
    - \Veeam.Backup.Service.exe
    - \Veeam.Backup.Manager.exe
  condition: selection and not filter
falsepositives:
- Scheduled maintenance tasks executed under the Veeam service account
- Custom backup pre/post scripts configured to run under the service identity
level: medium
tags:
- attack.t1210
- attack.persistence
- cve.2026-44963
id: 9dcb7e06-1a8f-5cfe-94f7-931951a277ac
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0712

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free