CVE-2026-44963 — Veeam Backup & Replication RCE

Research repository by SentinelX — for authorized security testing and defensive purposes only.

Overview

Vulnerability Description

CVE-2026-44963 is a Remote Code Execution (RCE) vulnerability in Veeam Backup & Replication caused by insecure deserialization of untrusted data (CWE-502). The vulnerability allows any authenticated domain user — with no elevated privileges required — to execute arbitrary code on the Backup Server remotely.

Key Characteristics

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low — any domain user (PR:L)
• User Interaction: None (UI:N)
• Scope: Full system + lateral movement potential
• Exploitation Condition: Target must be domain-joined

What Makes This Dangerous

Any domain account No elevated privilege needed

Network access to VBR server

Deserialization of crafted payload

RCE as SYSTEM/service account

Full backup infrastructure compromise

Repository Structure

CVE-2026-44963/
 README.md # This file
 docs/
 technical-analysis.md # Deep-dive technical breakdown
 timeline.md # Disclosure & patch timeline
 references.md # External references
 detection/
 scan_veeam.py # Discover Veeam instances on network (TCP scan)
 check_version.py # Check version via Veeam REST API (auth required)
 http_prober.py # Custom HTTP fingerprinter — no third-party tools
 remediation/
 patch_checker.py # Validate patch status
 hardening.ps1 # Post-patch hardening script
 lab/
 setup.md # Lab environment setup guide
 ioc/
 indicators.md # IoCs for SIEM/EDR detection

Quick Reference

Attack Flow (for authorized pentest)

1. Reconnaissance Identify domain-joined Veeam VBR instances
2. Enumeration Confirm version < 12.3.2.4854
3. Access Obtain any valid domain credentials
4. Exploitation Send crafted deserialization payload
5. Post-exploit Extract config DB, harvest creds, lateral move

Pentester Checklist

• Written authorization obtained
• Scope confirmed (domain-joined VBR servers in scope)
• Lab reproduction completed before live testing
• Rollback plan in place
• Logging/monitoring enabled for your actions

Detection

See ioc/indicators.md for full IoC list.

Key detection points:

• Anomalous process spawning from Veeam.Backup.Service.exe
• Unexpected .NET deserialization activity on Backup Server
• Unusual outbound connections from VBR host
• Auth logs: domain users authenticating to VBR outside normal hours

Remediation

Immediate: Patch to Veeam Backup & Replication 12.3.2.4854

Hardening:

• Restrict network access to VBR service ports
• Apply least-privilege to domain user access
• Isolate Backup Server in dedicated VLAN
• Enable enhanced logging on VBR

See remediation/hardening.ps1 for automated hardening script.

Legal Disclaimer

This repository is intended strictly for authorized security research, penetration testing with explicit written permission, and defensive/blue team purposes.

Unauthorized use of this material against systems you do not own or have explicit permission to test is illegal and may result in criminal prosecution.

SentinelX and the contributors of this repository are not responsible for any misuse of this information.

References

• Veeam KB4869 — Official Advisory
• NVD — CVE-2026-44963
• BleepingComputer Coverage
• WatchTowr — Sina Kheirkhah (@SinSinology)
• CWE-502: Deserialization of Untrusted Data

Made with by SentinelX | For the community, by the community