Veeam Releases Critical Security Patches for Backup & Replication Software
Veeam has recently issued security patches to resolve a critical vulnerability in its Backup & Replication software that could potentially lead to remote code execution.
Identified as CVE-2026-44963, this vulnerability has been assigned a CVSS score of 9.4 out of 10.0, signifying its severe impact.
In a statement released on Tuesday, Veeam acknowledged the presence of “a vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.”
Credit for the discovery and responsible disclosure of this vulnerability goes to watchTowr researcher Sina Kheirkhah. The issue affects Veeam Backup & Replication 12.3.2.4465 and all earlier versions of 12 builds.
It is important to note that version 13.x builds of the Veeam Backup & Replication software are not affected by this vulnerability, thanks to architectural enhancements introduced in version 13.
The identified vulnerability has been successfully addressed in Veeam Backup & Replication version 12.3.2.4854.
Earlier in March 2026, Veeam had also resolved multiple critical vulnerabilities in its Backup & Replication software that, if exploited, could lead to remote code execution.
Users are strongly advised to update to the latest version of the software to ensure optimal security, especially considering the past instances of bad actors exploiting vulnerabilities in the program, including ransomware groups.
