CVE-2024-40711: Veeam Backup and Replication Deserialization Vulnerability.
Veeam Backup and Replication Deserialization Vulnerability. Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
- CISA KEV-listed (remediation due 2024-11-07)
- used in ransomware campaigns
- EPSS 90.4% (99.8% percentile)
- CVSS 9.8 critical
Related briefings
- Hackers poison Bing search results to drop Akira ransomware on companies 2026-06-29
- Akira Topped Sophos Ransomware Cases in 2024, Peaked at 17% of August Detections Amid Veeam Exploits 2026-02-16
Linked threat actors
- Akira machine-inferred link