Exploitation observed; activity peaked at 20 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
| Date | Total | Labels |
|---|
| 2026-06-09 | 14 | Active Exploitation1Disclosure6Patch7 |
| 2026-06-10 | 20 | Active Exploitation2Disclosure3General1Patch14 |
| 2026-06-11 | 11 | Active Exploitation2Disclosure3Patch6 |
| 2026-06-13 | 1 | Patch1 |
| 2026-06-16 | 1 | Disclosure1 |
| 2026-06-18 | 1 | Patch1 |
| 2026-06-30 | 2 | Disclosure1Patch1 |
| 2026-07-06 | 6 | Disclosure3Patch3 |
| 2026-07-07 | 2 | Disclosure1PoC1 |
| 2026-07-08 | 1 | Disclosure1 |
| 2026-07-13 | 1 | Patch1 |
| 2026-07-14 | 1 | Disclosure1 |
| 2026-07-15 | 2 | Disclosure2 |
| 2026-08-08 | 1 | Patch1 |
| 2026-08-09 | 1 | Patch1 |
| 2026-08-11 | 1 | General1 |
| 2026-08-19 | 1 | Disclosure1 |
| 2026-08-20 | 3 | Active Exploitation1Disclosure1General1 |
| 2026-08-23 | 1 | Disclosure1 |
| 2026-09-03 | 1 | Disclosure1 |
CVE-2026-44963: Veeam Backup – Authenticated Domain User to RCE via BinaryFormatter Blacklist Bypass https://blog.securelayer7.net/cve-2026-44963-veeam-backup-authenticated-rce-binaryformatter-bypass/
Post summary
The post announces CVE-2026-44963 as an authenticated RCE vulnerability in Veeam Backup through a BinaryFormatter blacklist bypass.
🚨 A single domain user could run code on your Veeam Backup Server. Veeam has patched a critical RCE flaw (CVE-2026-44963, CVSS 9.4) in Backup & Replication. All v12 builds up to 12.3.2.4465 are affected. Fixed in 12.3.2.4854. v13.x is safe. Patch now: https://thehackernews.com/2026/06/veeam-backup-replication-rce-flaw-lets.html
Post summary
Veeam disclosed a critical RCE flaw (CVE-2026-44963) allowing code execution by a domain user, and released a patch (12.3.2.4854) with details linked.
🚨 #LYNX #Ransomware uses #VEEAM #0days! An unauthenticated & private variant of CVE-2026-44963 is being used #Europol https://theravenfile.com/2026/08/20/veeam-under-fire-understanding-cve-2026-44963-ransomware-group-exploit-claims/ #threatintel #OSINT #0day #zeroday #exploit #infosec #security #malware #hack #threatintelligence #CyberSec #CISA #FBI #Europol #TOR
Post summary
The tweet indicates that the LYNX ransomware group is actively exploiting the Veeam CVE-2026-44963, with Europol acknowledging usage of a private unauthenticated variant.
#AppSec #Threat_Research 1⃣ Veeam Backup Authenticated RCE Explained https://blog.securelayer7.net/cve-2026-44963-veeam-backup-authenticated-rce-binaryformatter-bypass // CVE-2026-44963 2⃣ Multiple LPE Vulnerabilities in Little Orbit GFAC Driver (GFAC_Sys_x64.sys) https://github.com/FzRsLLaSheR/CVE-2026-12166_CVE-2026-12167_CVE-2026-12168 3⃣ Seven FatFs bugs, one very large blast radius https://www.runzero.com/blog/fatfs-bugs // CVE-2026-6682 - CVE-2026-6688 + PoCs https://github.com/runZeroInc/vulns-2026-fatfs-chance http://www.cyberpocket.org
Post summary
The tweet summarizes several new CVE disclosures, each accompanied by proof‑of‑concept links and technical details, but offers no evidence of active exploitation or patches.
Vulnerabilidad crítica de Veeam permite ataques RCE en servidores de respaldo Veeam Backup & Replication, una de las soluciones de respaldo empresarial más utilizadas a nivel mundial Identificada como CVE-2026-44963, este fallo permite que usuarios autenticados del dominio ejecuten código arbitrario de forma remota en los servidores de respaldo https://blog.elhacker.net/2026/06/vulnerabilidad-critica-de-veeam-permite.html
Post summary
Se descubre un fallo crítico de ejecución remota en Veeam Backup & Replication que permite a usuarios autenticados del dominio ejecutar código arbitrario en servidores de respaldo (CVE‑2026‑44963).
No hay año sin vuln crítica en Veeam Backup... https://www.veeam.com/kb4869 --> Parchea o me verás entrar por la puerta (!y ninguno de los dos queremos que eso suceda!) CVE-2026-44963
Post summary
The message highlights a critical Veeam Backup CVE and stresses the need to apply the vendor patch to prevent potential exploitation.
The Backup that Backfired: How One Whitelisted ObjRef Hands Any Veeam Domain User SYSTEM (CVE-2026-44963) https://api.cyfluencer.com/s/the-backup-that-backfired-how-one-whitelisted-objref-hands-any-veeam-domain-user-system-cve-2026-44963-29383/1
Post summary
The article announces CVE‑2026‑44963, highlighting that a whitelisted ObjRef can grant SYSTEM privileges to any Veeam domain user.
🚨 Upozorňujeme na kritickou zranitelnost ve Veeam Backup & Replication, CVE-2026-44963. Zranitelnost umožňuje vzdálené spuštění kódu (RCE) na Backup Serveru prostřednictvím autentizovaného doménového uživatele, což znamená, že útočník s platnými přihlašovacími údaji v doméně může zneužít chybu k převzetí kontroly nad serverem a provádění libovolného kódu. Chyba se týká verzí Veeam Backup & Replication 12.3.2.4465 a všech starších buildů řady 12, přičemž verze 13.x není zranitelností ovlivněna díky architektonickým změnám. 📌Doporučujeme aktualizovat na verzi 12.3.2.4854 či novější.
Post summary
Veeam Backup & Replication CVE-2026-44963 is a remote code execution flaw affecting older 12.x builds; the advisory urges users to upgrade to 12.3.2.4854 or newer, with no active exploitation or PoC details reported.
A critical Veeam Backup vulnerability (CVE-2026-44963) allows remote code execution. Patch immediately to avoid ransomware targeting CVE-2023-27532. #Veeam #CVE202644963 #CyberSecurity #RCE #Vulnerability http://securityonline.info/cve-2026-44963-veeam-rce/
Post summary
The post alerts that Veeam Backup (CVE-2026-44963) allows remote code execution and urges rapid patching, but no proof of exploitation or PoC is provided.
これだと今後も出てきそうですね... 『Each new disclosure since 2024 has been a researcher identifying another [Serializable] class outside the list』 CVE-2026-44963: Veeam Backup – Authenticated Domain User to RCE via BinaryFormatter Blacklist Bypass https://blog.securelayer7.net/cve-2026-44963-veeam-backup-authenticated-rce-binaryformatter-bypass/
Post summary
A newly disclosed CVE (CVE‑2026‑44963) enables authenticated Veeam Backup users to achieve remote code execution through a BinaryFormatter blacklist bypass, with a linked blog post providing details.
#Veeam: Veeam has released security updates to patch a critical Backup & Replication security flaw that can be exploited to gain remote code execution (#RCE) vulnerability CVE-2026-44963 on domain-joined backup servers: 👇 https://www.bleepingcomputer.com/news/security/new-veeam-vulnerability-exposes-backup-servers-to-rce-attacks/
Post summary
Veeam released security updates to address CVE‑2026‑44963, a critical RCE flaw in domain‑joined backup servers, with no indication of active exploitation or availability of exploit code.
Veeam fixed CVE-2026-44963, a critical 9.4 RCE flaw in Backup and Replication that let authenticated domain users run code on the Backup Server. Update to 12.3.2.4854. #Veeam #CVE202644963 #BackupRCE https://ift.tt/x3wKzqi
Post summary
Veeam has fixed CVE-2026-44963, a critical RCE flaw that allowed authenticated domain users to execute code on the Backup Server, and recommends users update to version 12.3.2.4854.
Veeam patched CVE-2026-44963 in Backup and Replication 12.3.2.4854, a flaw that could let a low-privileged domain user trigger RCE on domain-joined backup servers. Version 13.x is unaffected. #Veeam #RCE #Ransomware https://ift.tt/H1ZO5d7
Post summary
Veeam has released a patch for CVE‑2026‑44963, fixing a remote code execution flaw that could be triggered by low‑privileged domain users on domain‑joined backup servers; version 13.x is unaffected.
CVE-2026-44963, a CVSS 9.4 deserialization RCE in Veeam Backup & Replication 12.x, is actively referenced by Lynx Ransomware in negotiations, with unverified claims of a patch-bypass variant circulating on criminal forums. - CVE-2026-44963 abuses unsafe deserialization via BinaryFormatter/.NET Remoting (CWE-502). Any low-privilege domain user can achieve SYSTEM-level RCE on domain-joined Veeam servers running 12.x up to build 12.3.2.4465. Fixed in 12.3.2.4854 (June 2026). Version 13.x is not affected. Workgroup deployments are not vulnerable to this specific flaw. - Lynx Ransomware operators described exploiting Veeam to RCE, creating a local admin account, then dumping backup and domain admin credentials for full network compromise. They claimed a private unauthenticated variant that bypasses the patch. Unverified as of mid-August 2026, but a September 2025 underground sale matching the same privilege level and impact suggests CVE-2026-44963 was privately traded before official disclosure. - Credential harvesting from Veeam.Backup.Service.exe via CVE-2023-27532 remains the most common Veeam attack vector across ransomware groups, used in over 70% of observed cases. Backup servers are prioritized because attackers gain hypervisor credentials, can delete repositories, and destroy recovery options before deploying ransomware. Patch to 12.3.2.4854 immediately. #DFIR_Radar
Post summary
The post details the high‑severity CVE‑2026‑44963 in Veeam Backup & Replication 12.x, notes active exploitation by Lynx ransomware, and urges upgrading to the June 2026 patch 12.3.2.4854.
CVE-2026-44963 allows authenticated domain users to execute remote code on Veeam Backup & Replication servers, affecting versions 12.x; fixed in 12․3․2․4854 https://ift.tt/ukJRBjM
Post summary
CVE‑2026‑44963 allows authenticated domain users to execute remote code on Veeam Backup & Replication 12.x servers; the issue is fixed in update 12.3.2.4854.
⚠️ ALERT! Vulnerabilidad CVE-2026-44963 con origen en una deserialización de datos no confiables (CWE-502) en el Backup Server de Veeam Backup & Replication permite a un atacante manipular datos serializados que el servidor procesa y ejecuta. Más info: https://hubs.la/Q04n1L5C0
Post summary
The post alerts readers to a newly disclosed vulnerability (CVE-2026‑44963) in Veeam Backup & Replication caused by unsafe data deserialization, with no PoC, exploit, or patch details provided.
Warning: Critical vulnerability in #Veeam Backup & Replication allows Remote Code Execution (#RCE) on the Backup Server by an authenticated domain user. CVE-2026-44963 CVSS:4.0 9.4. Read our advisory https://ccb.belgium.be/advisories/warning-critical-remote-code-execution-veeam-backup-replication-patch-immediately and #patch #patch #patch
Post summary
A critical RCE vulnerability (CVE‑2026‑44963) in Veeam Backup & Replication has been disclosed; the advisory urges immediate patching.
Veeam Backup & Replication RCE Critical RCE in Veeam Backup & Replication. CVE-2026-44963, CVSS 9.4 any authenticated domain user can run code on the Backup Server. Low privilege bar, high-value target: backup infra is what ransomware crews hit first. Affects domain-joined VBR v12 (≤ 12.3.2.4465); v13.x not affected. Fixed in 12.3.2.4854. No in-the-wild reports yet, but VBR has a long history of being weaponized (Akira, Fog, Frag). Found by Sina Kheirkhah, watchTowr. Patch now; consider a workgroup config per Veeam’s hardening guide. Source: BleepingComputer @VulnerabilityNw
Post summary
Veeam Backup & Replication has a critical authenticated remote code execution flaw (CVE-2026-44963). No evidence of active exploitation yet, but a patch is available and additional configuration mitigations are recommended.
🔐 セキュリティトレンド (14:47 JST) ① Gitea 公式 Docker Imageに重大な脆弱性(CVE-2026-20896) - 合同会社ロケットボーイズ https://rocket-boys.co.jp/security-measures-lab/gitea-official-docker-image-vulnerability-cve-2026-20896/ ② 孫正義氏が予測する2040年--「AI企業に仕事を奪われる」時代の経営戦略 - (page 2) https://japan.zdnet.com/article/35250537/2/ ③ 脆弱性対策情報データベースJVN iPediaの登録状況 [2026年第2四半期（4月〜6月）] - IPA https://www.ipa.go.jp/security/reports/vuln/jvn/ipedia2026q2.html ④ Microsoftが7月の月例パッチ公開、悪用確認済みを含む多数の脆弱性を修正（クラウド Watch） https://news.yahoo.co.jp/articles/012820a57ec3e775cb86d16b246d4453024eff7b ⑤ Veeam Backup & Replicationに重大なRCE 脆弱性(CVE-2026-44963) https://rocket-boys.co.jp/security-measures-lab/veeam-backup-rce-cve-2026-44963/ #セキュリティ #CyberSecurity
Post summary
The text announces significant vulnerabilities, including a critical issue in Gitea Docker images and a remote code execution flaw in Veeam Backup, but provides no evidence of active exploitation, PoC, or patches.
Veeam Backup & Replication の脆弱性 CVE-2026-44963：BinaryFormatter の欠陥を突く RCE https://iototsecnews.jp/2026/07/06/veeam-backup-binaryformatter-flaw-enables-remote-code-execution/ 今回の脆弱性の原因は、Veeam Backup & Replication に使われている BinaryFormatter という仕組みにあります。これはデータを復元する際に、あらかじめ禁止されたクラスだけを阻止するブラックリスト方式を採用していました。しかし、この方式では登録漏れがある危険なクラスを完全に防ぎきれません。実際に CVE-2026-44963 (CWE-502) では、未登録のクラスを悪用して、管理者権限がなくても外部から自由にコマンドが実行できてしまいます。このように安全ではない古いデータ復元手法への依存と、不完全な禁止リストによる設計が、問題の根本的な原因となっています。ご利用のチームは、ご注意ください。 #BackupandReplication #BinaryFormatter #CVE202644963 #Veeam #Vulnerability
Post summary
A new deserialization flaw (CVE‑2026‑44963) in Veeam Backup & Replication allows remote code execution via BinaryFormatter. No PoC, exploit, patch, or active exploitation reports are provided, only vulnerability details.