Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
| Veeam | Veeam Backup \& Replication |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Source | Exploited | Ransomware Use | Notes |
|---|---|---|---|
| cisa-kev | Yes | Known | KEV entry: Veeam Backup and Replication Deserialization Vulnerability | Affected: Veeam / Backup & Replication | Description: Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2024-11-07 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.veeam.com/kb4649 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40711 |
| kevintel | Yes | Known | KEVIntel entry: A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). | Affected: Veeam / Backup and Recovery | CVSS: 9.8 (CRITICAL) | Used in malware: yes | Not yet in CISA KEV: False |
| Vendor Source | Status | Statement |
|---|---|---|
| Red Hat CSAF VEX | known not affected (1) | Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references. |
| Ransomware Group | Vendor | Product | Source |
|---|---|---|---|
| Akira | Veeam | Backup & Replication | @SophosXOps |