CVE-2024-40711 | BDVDB-2026-247667 Detail

VeeamBackup and Recovery

Description#

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

Per CVSS v3.0: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.

No public exploit known

9.8 Critical

90.3%, Very High

Estimated chance of exploitation in the next 30 days. EPSS percentile: 99.8.

Yes

Listed in the CISA Known Exploited Vulnerabilities catalog.

Insecure Deserialization

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Not available

Not available

9.8 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Not available

Source: CVE List v5 (record); CISA KEV (kev, action); FIRST EPSS (epss).