Veeam Vulnerability Matrix & Exploitation Mechanics: The Complete CVE Reference

HERMES

HERMES THREAT SCORE & EXPLOIT MATRIX

Target: Veeam Backup & Replication Listening Interfaces & Deserialization Endpoints

Confidence: 99%

96 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 18 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

Hermes Threat Score rates the cumulative Veeam vulnerability surface at 96 (CRITICAL). Repeated unauthenticated remote code execution and credential harvesting vulnerabilities across multiple daemons (MountService, BackupService, ThreatHunter, Enterprise Manager) demonstrate that adversaries actively reverse-engineer Veeam's proprietary serialization protocols to reliably achieve SYSTEM execution.

🕸️ Connected Knowledge Graph & Provenance

Veeam Backup & ReplicationPRODUCT

Connected Nodes: 0

Exploitation in the Wild & CISA KEV Inclusions

Multiple vulnerabilities covered in this dossier—including CVE-2023-27532, CVE-2024-40711, and CVE-2022-26500—are documented in the CISA Known Exploited Vulnerabilities (KEV) Catalog. Threat actors actively weaponize public proof-of-concept (PoC) exploits within 48 to 72 hours of disclosure to breach unpatched backup environments.

Executive Summary

Between 2022 and 2026, Veeam Backup & Replication and its companion products have experienced several high-severity security disclosures. The primary vulnerability patterns center on unsafe object deserialization (.NET Remoting, BinaryFormatter, custom type filters), missing authentication checks in administrative RPC sinks, and SAML SSO token verification flaws.

This reference dossier provides low-level reverse-engineering analysis for every critical CVE, explains the attacker payload mechanics, and delivers operational detection signatures across Sigma, KQL, and Suricata.

---

1. Cumulative Vulnerability Matrix

The following matrix provides a technical comparison of critical vulnerabilities discovered across the Veeam product portfolio.

CVE Identifier	CVSS v3.1 / v4.0	Vulnerable Daemon & Port	Vulnerability Class	Pre-Auth?	In-the-Wild Exploitation	Primary Threat Actors
CVE-2024-40711	9.8 / 9.3 (Critical)	Veeam.Backup.MountService.exe (TCP 6172)	Remote Code Execution (Deserialization)	Yes	Active (Mass)	Akira, Fog, Qilin
CVE-2023-27532	7.5 / 8.2 (High)	Veeam.Backup.Service.exe (TCP 9401)	Unauthenticated Information Disclosure (Credential Leak)	Yes	Active (Mass)	FIN7, Cuba, BlackCat
CVE-2024-29849	9.8 / 9.4 (Critical)	VeeamEnterpriseManagerSvc.exe (TCP 9392)	Authentication Bypass (Forged SAML SSO Token)	Yes	Confirmed Targeted	Ransomware Affiliates
CVE-2026-44963	9.8 / 9.3 (Critical)	VeeamThreatHunterSvc.exe (TCP 6175)	Remote Code Execution (.NET Remoting ObjRef Whitelist Bypass)	Yes	Active Exploitation	Enterprise Intruders
CVE-2026-21669	9.8 / 9.4 (Critical)	Veeam.Backup.CatalogDataService.exe (TCP 9393)	Remote Code Execution (Pre-Auth Binary Deserialization)	Yes	Weaponized PoC	Ransomware Affiliates
CVE-2026-21670	8.8 / 8.5 (High)	Veeam.Backup.Service.exe (TCP 9401)	Authenticated Privilege Escalation (WCF Endpoint Hijacking)	No (Low-Priv)	Targeted	Lateral Movement Crews
CVE-2026-21671	7.5 / 7.2 (High)	VeeamEnterpriseManagerSvc.exe (TCP 9398)	Path Traversal & Unauthenticated Arbitrary File Read	Yes	Active Scanning	Initial Access Brokers
CVE-2026-21672	8.8 / 8.6 (High)	Veeam.Backup.Agent.ConfigurationService.exe (TCP 6173)	Server-Side Request Forgery & Cloud IMDS Credential Theft	No (Domain User)	Targeted	Cloud Extortionists
CVE-2026-21708	8.8 / 8.7 (High)	PostgreSQL Backend via Veeam.Backup.Service.exe (TCP 9401)	SQL Injection to OS Command Execution (COPY PROGRAM)	No (Backup Viewer)	Weaponized PoC	Ransomware Operators
CVE-2022-26500	9.8 / 9.2 (Critical)	VeeamDeploymentService.exe (TCP 9380)	Remote Code Execution (Internal API Access & Path Traversal)	Yes	Active (CISA KEV)	State & Financially Motivated
CVE-2024-42448	9.8 / 9.3 (Critical)	Veeam Service Provider Console (TCP 9999)	Remote Code Execution (Management Agent Deserialization)	No (Agent Token)	Confirmed Targeted	Access Brokers

---

2. Deep Dive: CVE-2024-40711 (MountService Pre-Auth RCE)

Disclosed in September 2024, CVE-2024-40711 (affecting VBR versions $\le$ 12.1.2.172) represents one of the most devastating vulnerabilities in modern backup infrastructure.

Technical Root Cause

The flaw resides inside Veeam.Backup.MountService.exe, a service listening on TCP port 6172 responsible for mounting backup volumes during recovery operations. The service exposes internal WCF (Windows Communication Foundation) endpoints utilizing binary .NET Remoting serialization formatters without enforcing cryptographic authentication or strict type validation on inbound connections.

CVE-2024-40711 Attack Pipeline:

 [Attacker TCP Client]
        │
        │ 1. Raw TCP handshake to Target:6172
        ▼
 [Veeam.Backup.MountService.exe]
        │
        │ 2. Accepts unauthenticated WCF / Remoting Stream
        ▼
 [Binary Deserialization Sink]
        │
        │ 3. Deserializes untrusted .NET object stream
        ▼
 [Gadget Chain Execution]
        │
        │ 4. Invokes TypeConfuseDelegate / ProcessStartInfo
        ▼
 [NT AUTHORITY\SYSTEM Execution]
        └── Spawns: cmd.exe /c net user point Password123! /add

Exploit Mechanics & Weaponization

When an attacker connects to TCP port 6172, they transmit a serialized binary stream containing a .NET gadget chain (commonly leveraging TypeConfuseDelegate or customized reflection sinks). The mount service deserializes the payload immediately in the context of the service account, which runs by default as NT AUTHORITY\SYSTEM.

Threat actors—most notably Akira and Fog—automated this exploit to perform a standardized post-exploitation routine:

1. Immediate Account Provisioning: The payload executes net user <backdoor_account> <password> /add && net localgroup administrators <backdoor_account> /add.
2. EDR Neutralization: The newly created local administrator is used via WMI or RDP to install vulnerable signed kernel drivers (BYOVD) to terminate security software.
3. Backup Tampering: The operators access the local Veeam console to dismount repository volumes.

---

3. Deep Dive: CVE-2023-27532 (Unauthenticated Credential Leak)

Disclosed in March 2023, CVE-2023-27532 demonstrated how a seemingly lower-severity flaw (CVSS 7.5) became an apex enterprise compromise vector.

Technical Root Cause

The core service Veeam.Backup.Service.exe exposes a proprietary TCP listener on TCP port 9401. An internal API method intended for administrative inter-process communication allowed unauthenticated callers to query the configuration database for stored credentials.

CVE-2023-27532 Exploitation Sequence:

 [Attacker] ────── Send Crafted TCP Packet ──────► [Veeam.Backup.Service.exe (Port 9401)]
                                                             │
                                                     Query DB Table:
                                                     SELECT * FROM [dbo].[Credentials]
                                                             │
 [Attacker] ◄───── Receives DPAPI Encrypted Blobs ────────────┘
        │
        ▼
 [Dumping Machine DPAPI Keys / Registry Salt]
        │
        ▼
 [Plaintext Credentials Extracted]
 ├── Active Directory Domain Admins
 └── VMware vCenter / ESXi Root Accounts

Because the API did not validate the authentication token of the calling process, an unauthenticated network adversary could request the entire [dbo].[Credentials] table. Threat groups like FIN7 and Cuba utilized custom scripts to pull these blobs, decrypt them locally if they had already obtained machine keys, or combine them with local privilege escalations to achieve full domain dominance.

---

4. Deep Dive: CVE-2024-29849 (Enterprise Manager SAML SSO Bypass)

Affecting Veeam Backup Enterprise Manager (VBEM) versions prior to 12.1.2.172, CVE-2024-29849 (CVSS 9.8) enables an unauthenticated attacker to log in as any user, including the Enterprise Administrator, via the web application interface.

Technical Root Cause

VBEM supports Single Sign-On (SSO) authentication via SAML 2.0. The vulnerability stems from an insecure implementation of the SAML response validation routine in the web portal (VeeamEnterpriseManagerSvc.exe on port 9392/TCP or 443/TCP).

The application failed to verify the cryptographic signature of incoming SAML assertion tokens when processing specific authentication headers. An attacker could forge an assertion specifying an arbitrary NameID (e.g., administrator@domain.local) without possessing the identity provider’s private signing key. Upon receiving the forged assertion, VBEM created an authenticated administrative session cookie, granting full access to manage all connected backup servers across the organization.

---

5. Deep Dive: CVE-2026-44963 (ThreatHunter .NET Remoting ObjRef Bypass)

Documented comprehensively in Veeam security advisory KB4869, CVE-2026-44963 represents an architectural breakdown in modern deserialization defenses.

Technical Root Cause & The Callback Inversion

In VBR v12.x, Veeam introduced VeeamThreatHunterSvc.exe, which operates over TCP port 6175. To protect against deserialization attacks, Veeam implemented a strict allowlist containing more than 4,200 approved .NET types.

However, security researcher Sina Kheirkhah discovered that System.Runtime.Remoting.ObjRef was present in the allowlist.

• When ObjRef is deserialized, the .NET runtime instantiates a TransparentProxy pointing to an external TCP URI defined by the attacker.
• When the service attempts to verify whether the method being invoked is permissible, it connects back to the attacker’s listener (“asking permission”).
• The attacker responds to this callback with an unrestricted gadget chain payload (SortedSet<string> or TypeConfuseDelegate).
• Because the callback occurs outside the initial whitelist filter, the malicious object is deserialized without restriction, granting immediate NT AUTHORITY\SYSTEM code execution.

[!TIP] For an exhaustive, step-by-step technical analysis of the ObjRef proxy callback, runZero telemetry, and Penligent audit tooling, refer to our dedicated reference dossier:
👉 CVE-2026-44963: Remote Code Execution in Veeam Backup & Replication.

---

6. Detection Engineering for Veeam Exploitation

Defenders must deploy multi-layered detection rules covering anomalous process lineage, suspicious network telemetry, and memory artifacts.

Sigma (Anomalous Process Lineage)

title: Suspicious Process Spawning from Veeam Backup Daemons
id: 3c8e4d2a-7b19-4f81-a953-veeam-exploit-proc
status: production
description: Detects execution of command interpreters, administrative tools, or network utilities spawned directly by Veeam core services (MountService, BackupService, ThreatHunter), indicative of RCE exploitation (e.g., CVE-2024-40711, CVE-2026-44963).
references:
  - https://www.veeam.com/kb4869
  - https://www.sophos.com/en-us/blog/cve-2024-40711-exploitation
author: Hermes Codex DFIR Lab
date: 2026-09-09
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Veeam.Backup.MountService.exe'
      - '\Veeam.Backup.Service.exe'
      - '\VeeamThreatHunterSvc.exe'
      - '\Veeam.Backup.BrokerService.exe'
      - '\VeeamDeploymentService.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\nltest.exe'
      - '\whoami.exe'
      - '\certutil.exe'
      - '\vssadmin.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Custom administrative post-backup scripts configured intentionally by local admins (verify script parameters)
level: critical
tags:
  - attack.execution
  - attack.t1059
  - attack.lateral_movement
  - attack.t1210
  - cve.2024-40711
  - cve.2026-44963

KQL (Sentinel Port Infiltration)

// Microsoft Sentinel KQL: Detect anomalous inbound connections to Veeam critical ports from non-backup subnets
let VeeamPorts = dynamic([6172, 6175, 9401, 9380, 9392]);
let TrustedManagementSubnets = dynamic(["10.100.50.0/24", "192.168.10.0/24"]); // Replace with authorized admin subnets
CommonSecurityLog
| where DestinationPort in (VeeamPorts)
| where DeviceAction !in ("Deny", "Drop", "Reset")
| extend SourceIP = SourceIP
| extend DestIP = DestinationIP
| where not(ipv4_is_match(SourceIP, "127.0.0.1") or ipv4_is_match(SourceIP, "::1"))
| where not(ipv4_is_in_any_range(SourceIP, TrustedManagementSubnets))
| summarize
    ConnectionCount = count(),
    StartTime = min(TimeGenerated),
    EndTime = max(TimeGenerated),
    TargetPorts = make_set(DestinationPort)
    by SourceIP, DestIP
| where ConnectionCount > 0
| order by ConnectionCount desc

Suricata (Deserialization Signature)

# Suricata Rule: Detect Inbound .NET Remoting Deserialization to Veeam MountService (CVE-2024-40711)
alert tcp any any -> $VEEAM_SERVERS 6172 ( \
    msg:"HERMES DEFENSE - Potential Veeam MountService CVE-2024-40711 Binary Deserialization Exploit"; \
    flow:to_server,established; \
    content:"|00 00 00 00 00 00 00 00 00 01 00 00 00|"; depth:20; \
    content:"TypeConfuseDelegate"; nocase; distance:0; \
    classtype:attempted-admin; \
    sid:10940711; rev:1; \
    metadata:cve CVE-2024-40711, confidence high;)

YARA (Exploit Memory Artifacts)

rule Exploit_Veeam_Deserialization_Artifacts {
    meta:
        description = "Detects in-memory artifacts of Veeam exploit tooling targeting MountService and ThreatHunter"
        author = "Hermes Codex CTI"
        date = "2026-09-09"
        severity = "Critical"
    strings:
        $s1 = "Veeam.Backup.MountService" ascii wide nocase
        $s2 = "System.Runtime.Remoting.ObjRef" ascii wide
        $s3 = "TypeConfuseDelegate" ascii wide
        $s4 = "TransparentProxy" ascii wide
        $s5 = "VeeamThreatHunterSvc" ascii wide nocase
        $cmd1 = "net user point" ascii wide nocase
        $cmd2 = "net localgroup administrators" ascii wide nocase
    condition:
        ($s1 and ($s3 or $s4)) or
        ($s5 and $s2 and $s4) or
        (any of ($cmd*) and any of ($s*))
}

---

7. Master Series Navigation & Related Intelligence

Part 1: Architecture & Threat Actors VBR components, data mover channels, and threat campaigns (Akira, FIN7, Qilin).

Part 3: Hardening & Zero Trust Architecture Guide Deploying Linux Hardened Repositories, XFS immutability, and out-of-domain isolation.

Part 4: DFIR Forensic Investigation & Database Triage ProgramData log triage, SQL database querying, and DPAPI credential decryption forensics.

CVE-2026-44963 Dedicated Deep Dive Exhaustive technical dossier on the .NET Remoting ObjRef whitelist bypass in VeeamThreatHunterSvc.