CVE-2024-40711

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Sep 7, 2024
Last modified
Jun 17, 2026
Added to CISA KEV
Oct 17, 2024
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-407127.8A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege esCVE-2024-407137.8A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor AutheCVE-2024-407148.3An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitiveCVE-2024-407157.7A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypasCVE-2024-407178.8A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updaCVE-2024-407188.8A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vuCVE-2024-407196.5The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a reCVE-2024-40725.4A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been classified as problematic. Affected is aCVE-2024-407208.8The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a uCVE-2024-407218.8The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a uCVE-2024-407224.3The specific API in TCBServiSign Windows Version from CHANGING Information Technology does does not properly validate the length of server-sCVE-2024-407234.3The specific API in HWATAIServiSign Windows Version from CHANGING Information Technology does not properly validate the length of server-sid