CVE-2024-40711 is a deserialization-of-untrusted-data flaw in Veeam Backup & Replication that lets a remote, unauthenticated attacker run arbitrary code on the backup server, and CISA's KEV catalog records known ransomware campaign use against it, so any affected build should be patched immediately.
Vulnerability summary
9.8
Critical
90.4%
EPSS score (FIRST)
Yes
CISA KEV catalog
2024-09-07
Published
Vulnerability ID: CVE-2024-40711 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Veeam Backup & Replication | cpe:2.3:a:veeam:veeam_backup_&_replication:*:*:*:*:*:*:*:* | 12.0.0.1420 through 12.1.2.172 (fixed in 12.2, build 12.2.0.334) |
| Veeam ONE, Veeam Service Provider Console, Veeam Agent for Linux, Veeam Backup for Nutanix AHV / Red Hat Virtualization (same deserialization component, per Veeam's September 2024 bulletin) | — | Veeam ONE 12 and earlier (fixed in 12.2.0.4093); Veeam Service Provider Console 7-8 (fixed in 8.1.0.21377); Veeam Agent for Linux 6 and earlier (fixed in 6.2.0.101); Veeam Backup for Nutanix AHV/RHV 12 and earlier |
What this means
CVE-2024-40711 is a deserialization of untrusted data vulnerability (CWE-502) in Veeam Backup & Replication. Security researchers at watchTowr Labs found that the product's .NET Remoting deserialization blacklist was missing the System.Runtime.Remoting.ObjRef gadget; by wrapping that gadget inside an object type that is allowed through the blacklist, and reaching it through a backup-server endpoint whose IsConnectingIdentityAuthorized check unconditionally returned true, an attacker with no credentials at all could trigger unsafe deserialization and get code execution on the backup server (watchTowr Labs).
NVD's own analysis rates the flaw CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction needed, full compromise of confidentiality, integrity and availability (NVD).
Veeam's own September 2024 security bulletin (KB4649) lists Backup & Replication 12 and earlier through build 12.1.2.172 as vulnerable, fixed in 12.2 (build 12.2.0.334), and notes the same underlying component also required fixes in Veeam ONE (fixed 12.2.0.4093), Veeam Service Provider Console (fixed 8.1.0.21377), Veeam Agent for Linux (fixed 6.2.0.101) and Veeam Backup for Nutanix AHV/Red Hat Virtualization (Veeam KB4649).
CISA added CVE-2024-40711 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-10-17 with a required-action due date of 2024-11-07, and flags known ransomware campaign use — backup infrastructure is a high-value target because disabling recovery before encrypting production data increases ransom leverage (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.9037 (99.799th percentile), consistent with a vulnerability under sustained scanning and exploitation (FIRST EPSS).
Organizations running an affected Veeam Backup & Replication build should patch to 12.2 (12.2.0.334) or later immediately, treat any internet-exposed backup server on an older build as potentially compromised, and update the other bundled products listed above to their fixed builds.
Evidence
- Deserialization of untrusted data in Veeam Backup & Replication's .NET Remoting layer lets an unauthenticated remote attacker execute arbitrary code, by wrapping a missing-from-blacklist ObjRef gadget inside an allowed type and reaching it via an endpoint whose identity check always returns authorized. — watchTowr Labs
- CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, per NVD's own analysis. — NVD
- Affected: Veeam Backup & Replication 12.0.0.1420 through 12.1.2.172, fixed in 12.2.0.334; also fixed in Veeam ONE 12.2.0.4093, Veeam Service Provider Console 8.1.0.21377, Veeam Agent for Linux 6.2.0.101, and Veeam Backup for Nutanix AHV/RHV. — Veeam KB4649
- Added to the CISA Known Exploited Vulnerabilities catalog on 2024-10-17, due date 2024-11-07, with known ransomware campaign use. — CISA KEV
- EPSS score is 0.9037 (99.799th percentile) as of 2026-10-30. — FIRST EPSS
