VEEAM UNDER FIRE: Understanding CVE-2026–44963 & Ransomware Group Exploit Claims

What it is

CVE-2026-44963, a critical (CVSS v4 9.4) unsafe-deserialization RCE in Veeam Backup & Replication 12.x, disclosed by Veeam in June 2026. An authenticated low-privilege domain user can execute arbitrary code on a domain-joined Backup Server over the network. The post pairs the confirmed CVE with a Lynx ransomware negotiation transcript and an Exploit-forum listing claiming an unauthenticated SYSTEM-level variant.

How it works

Root cause is CWE-502 unsafe deserialization via BinaryFormatter / .NET Remoting: crafted data is deserialized back into live objects and executed as commands. Veeam's mitigation is blacklist-based (blocking known gadget classes), which the author notes is repeatedly defeated by discovering new serializable classes — the same pattern behind prior Veeam RCEs including CVE-2024-40711.

Preconditions / Affected

• Affected: all 12.x builds up to and including 12.3.2.4465.
• Fixed: 12.3.2.4854 (released June 2026).
• Not affected: version 13.x (architectural changes); workgroup deployments — only domain-joined Backup Servers are exploitable.
• Privilege: any domain user; no elevated Veeam role needed.

The Lynx-reported kill chain: identify the Veeam host → RCE → create local admin account → dump backup credentials and domain admin accounts → full network compromise. This is why the server matters — it holds credentials to the whole recovery estate.

What to do

Patch domain-joined 12.x servers to 12.3.2.4854 or move to 13.x. The page's defense section is truncated in the fetched text, so no commands are given beyond the fixed-version target. Treat backup-server local-admin account creation and credential-dumping as detection signals given the reported TTPs.

Caveats

The dangerous claims are unverified. As of mid-August 2026 there is no independent technical analysis, no confirmed in-the-wild unauthenticated exploitation, and no vendor acknowledgment of a residual unauthenticated bug. The only sources for the "improved" variant are one forum advertisement and the Lynx negotiation itself — and the author explicitly flags that claiming private/0-day variants is standard ransomware negotiation leverage to justify higher demands. The historical plausibility argument (prior near-unauthenticated Veeam flaws, staged/incomplete patches, defeated blacklists) is framed as possible, not proven.

flowchart TD
    A[Domain user account] --> B{Server domain-joined<br/>and 12.x ≤ 12.3.2.4465?}
    B -- No: workgroup or 13.x --> X[Not exploitable]
    B -- Yes --> C[Deserialization RCE]
    C --> D[Local admin + credential dump]
    D --> E[Full network compromise]
    P[Patch to 12.3.2.4854] -. cuts chain .-> C

Note: the unauthenticated SYSTEM-level path claimed by Lynx and the forum seller — bypassing the June 2026 patch, affecting even 12.3.2.4854 — is a separate, unconfirmed branch not represented as established fact.