CVE-2024-40711
Veeam Backup and Replication Deserialization Vulnerability
Published Sep 7, 2024 · updated Jun 17, 2026 · veeam veeam backup & replication
Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
Timeline
Detection, updates, and resolution for this record.
Sep 7, 2024 · Catalog
Detected
Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
Oct 17, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Nov 7, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Nov 7, 2024
Affected
- cpe veeam/veeam backup & replicationversion unspecified
- vendor Veeam Backup & Replicationversion unspecified
Sources
- CISA KEVCVE-2024-40711
Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
cisa.gov - CVE.orgCVE-2024-40711
Official CVE identifier
cve.org - FIRST EPSSCVE-2024-40711
30-day exploitation probability 90.4%
first.org - NIST NVDCVE-2024-40711
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
nvd.nist.gov