← All advisories

Critical severity9.8CISA KEVNVD Advisory· Published Sep 7, 2024· Updated Jun 17, 2026

CVE-2024-40711

CVE-2024-40711

Description

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3

Veeam/Veeam Backup \& Replication2 versions
cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*range: >=12.0.0.1420,<12.2.0.334
- (no CPE)
Veeam/Backup and Recoveryv5
Range: 12.1.2

Patches

Vulnerability mechanics

References

3

labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/nvdExploitThird Party Advisory
www.veeam.com/kb4649nvdVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

1

New Veeam vulnerability exposes backup servers to RCE attacks
BleepingComputer · Jun 9, 2026