CVE-2024-40711
Veeam Backup and Replication Deserialization Vulnerability
Description
CVE-2024-40711 is a critical deserialization of untrusted data vulnerability in Veeam Backup & Replication that allows an unauthenticated attacker to achieve remote code execution (RCE) by sending a malicious payload. The flaw affects Veeam Backup & Replication versions 12.0.0.1420 through 12.1.x, prior to the patched version 12.2.0.334. With a CVSS v3.1 base score of 9.8 (CRITICAL), no privileges or user interaction required, and a known ransomware nexus, this vulnerability poses an extreme threat to enterprise backup infrastructure. CISA added CVE-2024-40711 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 68.20% at the 98.6th percentile confirms widespread exploitation by ransomware operators.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| veeam | veeam backup \& replication | >= 12.0.0.1420, < 12.2.0.334 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.veeam.com/kb4649(Vendor Advisory)
- https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40711(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2024-40711 exploits a deserialization of untrusted data weakness in Veeam Backup & Replication where the application deserializes attacker-controlled data without proper validation. Deserialization vulnerabilities occur when an application reconstructs objects from serialized data provided by untrusted sources, allowing attackers to inject malicious objects that execute arbitrary code during the deserialization process. In this case, the Veeam service processes specially crafted serialized payloads that trigger code execution with the privileges of the Veeam service account.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
The impact of CVE-2024-40711 is catastrophic, with Confidentiality (High), Integrity (High), and Availability (High) fully compromised. The attack is network-accessible (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N), enabling any attacker with network access to the Veeam service to gain complete control. Veeam Backup & Replication is the most widely deployed enterprise backup solution, protecting over 450,000 customers globally. Compromising the backup server gives attackers access to all backed-up data, the ability to delete or encrypt backup repositories, and a strategic position from which to ensure ransomware victims cannot recover their data. The confirmed ransomware nexus (Ransomware=Known) reflects the reality that multiple ransomware groups, including Akira and Fog, have been observed exploiting this vulnerability to destroy backups before deploying their ransomware payloads. The EPSS score of 68.20% at the 98.6th percentile underscores the breadth of active exploitation campaigns.
Exploit Maturity
CVE-2024-40711 has achieved full exploit maturity with widespread weaponization by ransomware groups. CISA confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 7, 2024, and explicitly tagged it with a known ransomware association. The EPSS score of 68.20% at the 98.6th percentile reflects significant ongoing exploitation. Detailed technical analysis and proof-of-concept exploit code were published by watchTowr Labs, demonstrating the deserialization attack chain. Multiple ransomware groups including Akira and Fog have incorporated this exploit into their attack playbooks, specifically targeting backup infrastructure to prevent recovery. Veeam published a security advisory at KB4649 documenting the vulnerability and patch. The combination of public exploit code, ransomware weaponization, and Veeam's massive market share makes this one of the most consequential vulnerabilities for enterprise data protection in 2024.
Remediation
-
Upgrade Veeam Backup & Replication immediately to version 12.2 (build 12.2.0.334) or later as documented in Veeam KB4649. This update patches the deserialization vulnerability and should be treated as an emergency update given the active ransomware exploitation.
-
Restrict network access to the Veeam Backup server by ensuring that the Veeam services (particularly TCP ports 9392, 9401, and 9380-9381) are not accessible from untrusted networks. Implement strict firewall rules allowing only authorized management workstations and Veeam components to communicate with the backup server.
-
Verify backup integrity and implement immutable backups by checking that existing backup repositories have not been tampered with or encrypted. Enable immutable backup repositories using hardened Linux repositories, object storage with object lock, or other write-once storage to protect backups from ransomware destruction.
-
Audit Veeam server logs for indicators of compromise including unexpected service account activity, unusual network connections to the Veeam server, unauthorized job modifications, and evidence of credential harvesting. Check for web shells, new accounts, and modifications to Veeam configuration databases.
-
Implement the 3-2-1-1-0 backup rule ensuring at least one backup copy is air-gapped or immutable and cannot be accessed from the network even if the primary Veeam server is compromised. Test backup restoration procedures to confirm recoverability.
Technical Details
CVE-2024-40711 is a deserialization of untrusted data vulnerability in Veeam Backup & Replication. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates a network-accessible (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) and no user interaction (UI:N), with Unchanged scope (S:U) and maximum impact across confidentiality, integrity, and availability. The vulnerability exists in Veeam's .NET-based service architecture, where a network-facing endpoint accepts serialized .NET objects without proper type validation or deserialization filtering. The watchTowr Labs analysis revealed that the attack chain involves sending a specially crafted serialized payload to the Veeam service, which is deserialized using an insecure deserialization pattern. The malicious payload leverages .NET deserialization gadget chains to achieve arbitrary code execution in the context of the Veeam service account, which typically runs with SYSTEM-level privileges on the Windows server. While Veeam initially categorized this as requiring authentication, researchers demonstrated that the deserialization occurs before authentication checks are completed, making it exploitable by unauthenticated attackers. Affected versions span from build 12.0.0.1420 through the 12.1.x release line.
Frequently Asked Questions
Is CVE-2024-40711 being actively exploited?
Yes, CVE-2024-40711 is under active exploitation by multiple ransomware groups including Akira and Fog. CISA confirmed exploitation and added it to the Known Exploited Vulnerabilities catalog with a known ransomware association. Attackers specifically target backup infrastructure to prevent recovery.
What products are affected by CVE-2024-40711?
Veeam Backup & Replication versions 12.0.0.1420 through 12.1.x are affected. This includes all Veeam Backup & Replication 12 installations that have not been updated to version 12.2 (build 12.2.0.334) or later.
How do I fix CVE-2024-40711?
Upgrade Veeam Backup & Replication to version 12.2 or later immediately. Restrict network access to Veeam services, implement immutable backup repositories, and audit the server for indicators of compromise.
Why is CVE-2024-40711 particularly dangerous for ransomware attacks?
Veeam Backup & Replication is the primary data protection solution for hundreds of thousands of organizations. By compromising the backup server, ransomware operators can delete or encrypt all backup copies before deploying their ransomware, eliminating the victim's ability to recover data without paying the ransom.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.