Veeam CVE-2026-44963 puts domain-joined backup servers at RCE risk

Veeam CVE-2026-44963 puts domain-joined backup servers at RCE risk

Veeam has patched CVE-2026-44963, a critical vulnerability in Backup & Replication that allows an authenticated domain user to execute code on the Backup Server. The flaw carries a CVSS v4 score of 9.4 and is fixed in 12.3.2.4854. Veeam also says the issue does not affect version 13.x because of architectural changes.

That sounds narrow on paper, but it is exactly the sort of bug defenders should not downplay. Backup servers are high-trust systems, and once an attacker reaches them, the impact can quickly expand into credential theft, repository tampering, and recovery sabotage.

What the flaw is

According to Veeam, CVE-2026-44963 is an RCE condition on the Backup Server that affects domain-joined deployments only. The vendor credits WatchTowr researcher Sina Kheirkhah for reporting it.

The key detail is not just the code execution itself, but who can trigger it: a low-privilege authenticated domain user. In a real enterprise, that is not a comforting limitation. Attackers routinely arrive with valid credentials through phishing, password reuse, token theft, or an earlier foothold. If a backup platform trusts those accounts too much, the blast radius can be large.

Why backup servers matter so much

Backup infrastructure is not a passive archive. It is part of the resilience layer, which means it often has privileged access to sensitive systems, repositories, and management paths. That makes it a prime target for ransomware crews and extortion groups.

If attackers compromise a backup server, they may be able to:

• destroy or encrypt recovery data
• steal stored credentials
• tamper with backup jobs and repositories
• move laterally into other systems

That is why this issue belongs in the same urgency bucket as identity and perimeter exposure, not routine maintenance.

What changed

Veeam says the affected versions are 12.3.2.4465 and all earlier 12 builds. The fix is 12.3.2.4854.

The practical takeaway is simple: if your environment still runs an affected 12.x build and the backup server is domain-joined, treat this as a patch-now event. Waiting on the next standard maintenance window is the wrong default.

What defenders should do now

1. Patch immediately

Upgrade Veeam Backup & Replication to 12.3.2.4854 wherever 12.x is still deployed.

2. Review trust boundaries

Check whether backup servers really need to be domain-joined. If they do, reduce standing trust and tighten access control around admin paths.

3. Look for exposure and abuse

Inventory every exposed or weakly segmented backup server, then review recent logons, job changes, and unusual admin activity. If you already suspect compromise, this becomes an incident response case, not just a patching task.

4. Harden the backup plane

Treat backup infrastructure as a separate security zone. Stronger network segmentation, tighter admin paths, and reduced privilege are the baseline, not extras.

Bottom line

Veeam CVE-2026-44963 is another reminder that backup systems are high-value targets, not safety vaults outside the threat model. A low-privilege path to remote code execution on a domain-joined backup server is enough to turn recovery tooling into attacker infrastructure.

If you run affected 12.x builds, patching should already be underway.

References

1. Vulnerability Resolved in Veeam Backup & Replication 12.3.2.4854
2. New Veeam vulnerability exposes backup servers to RCE attacks
3. Critical Veeam RCE flaw Lets Low-Privilege Users Take Over Backup Servers
4. Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code