Attack Chain

1. An unauthenticated attacker identifies a public-facing or internally accessible Veeam Backup & Replication server running a vulnerable version (prior to 12.3.2.4854).
2. The attacker crafts a specialized malicious request designed to exploit the specific vulnerability (CVE-2026-44963) within the Veeam Backup & Replication service.
3. The crafted request is sent to the vulnerable Veeam Backup & Replication service, often targeting a specific network endpoint or component.
4. The vulnerable Veeam service processes the malicious input, leading to a bypass of security controls and successful injection of attacker-controlled code.
5. Arbitrary code, specified by the attacker, is executed on the server running Veeam Backup & Replication, typically under the context of the compromised Veeam service.
6. The attacker gains control over the compromised server, potentially with elevated privileges, enabling them to navigate the internal network.
7. The attacker leverages access to perform actions such as exfiltrating sensitive backup data, encrypting backups for ransomware deployment, or establishing persistent access within the environment.

Impact

Successful exploitation of CVE-2026-44963 leads to full remote code execution on the server hosting Veeam Backup & Replication. This results in the complete compromise of the backup infrastructure, enabling attackers to gain unauthorized access to all backed-up data, potentially delete or encrypt it, and establish a foothold for further lateral movement within the network. The highly sensitive nature of backup environments means an attack could lead to severe data loss, exfiltration of critical business information, significant operational disruption, and regulatory non-compliance. While specific victim counts are not available, the widespread use of Veeam Backup & Replication suggests a broad potential impact across various sectors.

Recommendation

• Apply the security update provided by Veeam (kb4869) immediately to patch CVE-2026-44963 on all affected Veeam Backup & Replication servers.
• Deploy the provided Sigma rules to your SIEM solution to detect potential exploitation attempts and post-exploitation activities.
• Ensure Sysmon process creation logging is enabled on all servers running Veeam Backup & Replication to capture data for the provided Sigma rules.
• Monitor network connections originating from Veeam Backup & Replication services for suspicious outbound traffic not aligned with normal backup operations, as highlighted by the network connection rule.