CVE-2026-44963

Published Jun 9, 2026

Last updated 7 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-44963 is a remote code execution (RCE) vulnerability identified in Veeam Backup Server, specifically impacting Veeam Backup & Replication. This flaw, categorized as a deserialization of untrusted data (CWE-502), allows an authenticated domain user to execute arbitrary code on the affected backup server. The vulnerability requires low privileges, meaning an attacker only needs an authenticated domain account to exploit it. Successful exploitation can lead to the execution of arbitrary code under the privileges of the backup service, potentially affecting the confidentiality, integrity, and availability of the system and connected components. Veeam has released a security advisory and patches to address this issue.

Description: A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.
Source: support@hackerone.com
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.4
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

Weaknesses

support@hackerone.com: CWE-502

Hype score: Not currently trending

References