CVE-2024-40711

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Veeam	Backup and Recovery	>= 12.1.2, <= 12.1.2
veeam	backup_\&_replication	<= 12.2.0.334

References

https://www.veeam.com/kb4649Vendor Advisory
https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40711US Government Resource

Timeline

Published: Sep 7, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: Oct 17, 2024
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-407127.8A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege es CVE-2024-407137.8A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authe CVE-2024-407148.3An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive CVE-2024-407157.7A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypas CVE-2024-407178.8A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by upda CVE-2024-407188.8A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vu CVE-2024-407196.5The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a re CVE-2024-40725.4A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been classified as problematic. Affected is a CVE-2024-407208.8The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a u CVE-2024-407218.8The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a u CVE-2024-407224.3The specific API in TCBServiSign Windows Version from CHANGING Information Technology does does not properly validate the length of server-s CVE-2024-407234.3The specific API in HWATAIServiSign Windows Version from CHANGING Information Technology does not properly validate the length of server-sid