Critical Veeam RCE flaw Lets Low-Privilege Users Take Over Backup Servers


Critical Veeam RCE Flaw Lets Low-Privilege Users Take Over Backup Servers

Pierluigi Paganini
June 09, 2026

Veeam addressed a critical RCE vulnerability flaw in Backup & Replication that lets low-privileged domain users take control of backup servers.

Veeam has patched a critical remote code execution vulnerability, tracked as CVE-2026-44963 (CVSS v4 Score of 9.4), affecting Backup & Replication version 12.x. The flaw could allow a low-privileged domain user to execute code on backup servers connected to an Active Directory domain, potentially leading to full system compromise.

The issue was fixed in version 12.3.2.4854 and does not affect Veeam Backup & Replication 13.x, which uses a different architecture.

WatchTowr researcher Sina Kheirkhah [@SinSinology] reported the issue.

“A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.” reads the advisory.

At this time, the vendor is not aware of any in-the-wild attacks exploiting this vulnerability. However, it warns that threat actors may begin exploiting it as soon as patches are released.

“It’s important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software.” continues the advisory. “This reality underscores the critical importance of ensuring that all customers use the latest versions of our software and install all updates and patches without delay.”

Ransomware and extortion groups often target Veeam Backup & Replication because backup systems are a critical part of an organization’s recovery process. If attackers compromise them, they can delete or encrypt backups, steal sensitive data stored in backup archives, and extract credentials that help them move deeper into the network. This makes recovery much harder and increases pressure on victims to pay. Veeam servers are especially attractive because they usually have high privileges and broad access to virtual machines and storage systems. As a result, attackers prioritize backup infrastructure early in their attack chain to weaken defenses before deploying ransomware.

In June 2025, Veeam rolled out security patches to address another critical security vulnerability, tracked CVE-2025-23121 (CVSS score of 9.9) in its Backup & Replication solution that can allow remote attackers to execute arbitrary code under certain conditions.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Pixar is the champion of animation, but not all of their movies have had the chance to shine. For 40 years, the studio has brought families together across 30 movies. Certain movies never enter the discussion of being among the studios’ best — they were overshadowed by other films, or they went direct-to-streaming on Disney+.

In honor of the 40th anniversary, here are four Pixar movies that are worth reevaluating in 2026.

Toy Story 4

A surprisingly strong sequel

In 2010, Toy Story 3 brought Pixar’s debut franchise to an emotional close, as Woody (Tom Hanks), Buzz (Tim Allen), and the gang said farewell to Andy, preparing for a new life with Bonnie (Madeleine McGraw). After bringing their genre-defining animated trilogy to a fitting conclusion, I was doubtful that any follow-up could ever live up to the trilogy’s legacy. However, I was pleasantly surprised when I finally found the time to watch Toy Story 4.

As the gang of toys and Bonnie embark on a trip, Woody sets out to help the handcrafted toy Forky (Tony Hale) while also reuniting with Bo Peep (Annie Potts), who has become a rescuer of stray toys. As expected, Pixar’s animation remains ever-impressive, but Toy Story 4 manages to recapture the charm of the original 3 movies and offer a surprisingly fitting epilogue to Woody’s story in particular. Even with a new installment on the horizon, the emotion behind Toy Story 4‘s major status quo change for the gang ensures that the movie will be able to stand on its own merits for many years to come.

Turning Red

A stylistic reinvention

2022’s Turning Red saw Pixar take another crack at a coming-of-age story. The young Mei (Rosalie Chiang) clashes with her mother, Ming Lee (Sandra Oh), leading to her learning that she inherited the power to turn into a gigantic red panda in moments of heightened emotion. With her favorite boy band in town, Mei and her friends plan to use these gifts to attend the concert. As the concert draws nearer, however, Mei continues to clash with her mother, building to a generational showdown to heal her family’s curse.

Amazon Fire TV Stick 4K Max

Integrations

Alexa

Storage

16GB


When compared to what came before, Turning Red is a drastic stylistic departure from Pixar’s filmography. Mei’s story is told in a more informal manner when compared to other features, as Mei breaks the fourth wall and is incredibly expressive when compared to how past features tiptoed the line between cartoon and realism. However, this stylistic decision gives Turning Red a unique charm while making its story feel all the more personal and emotional, as we are given a clearer insight into Mei’s state than any other Pixar protagonist that has come before.​​​​​​​

Monsters University

Expanding a universe

While Toy Story had proven that Pixar could create successful sequels, expanding on a movie was still a rare move for the studio in the early 2010s, with said franchise and Cars being an exception. As such, Monsters University had a lot of pressure placed upon its shoulders when it released. Set several years before the events of Monsters Inc, the prequel explores how Mike (Billy Crystal) and Sully (John Goodman) went from fierce rivals to the firmest of friends during their time at the titular scaring school.

Blending the setting and cast of Monsters Inc. with a teen college movie was an ideal choice to expand the world of this Pixar movie, as most of the charm found in Monstropolis comes from how it drastically imagined elements of our own world in its monstrous lens. Furthermore, it is interesting to see that Sully and Mike began as rivals, and Mike’s arc focusing on his struggle to be a scarer does add layers to where his journey ends in the original movie. As such, Monsters University is a worthy prologue to one of Pixar’s most enduring franchises.​​​​​​​

Soul

A deeper tale with age

Pixar is unafraid to tackle deeper and more mature subjects. However, I feel Soul stands as one of their most ambitious explorations yet. On the verge of fulfilling his dream, Joe (Jamie Foxx) is caught in a near-death experience, leading to him becoming a disembodied soul in the “Great Before.” When his soul is tasked to guide the reluctant 22 (Tina Fey) into finding the passion that will drive her during her time on Earth, Joe is taken on a journey to not only return to his body but also reconsider what drives him and what is important in life.

For a studio that has prided itself on packaging deeper themes into a family-friendly package, Soul easily stands as a movie that feels targeted for its older viewers. Children may be inspired to take joy in everything life can offer through 22’s journey, but Joe’s story is particularly relatable to those who have had to grapple with their passions being lost or an unpredictable turn in life putting a stop to a dream, and watching him regain that through his experiences with 22 is incredibly emotional. While it may not have had a chance to shine at the box office, Soul will stand as a fondly remembered Pixar classic. Hopefully, new viewers and young fans can begin to see the movie through different perspectives as they face their own trials.​​​​​​​


Subscription with ads

Yes, the Disney Basic plan

Simultaneous streams

Up to 4

Live TV

No

Price

Starting at $10/month

Family favorites, old classics, and exciting new TV all in one place.




Source link