A critical flaw in a popular backup server allowed code execution without a password and was used by ransomware groups. How to protect the backup system itself.
Publicly disclosed: 5 September 2024
Backups are the last line of defense against ransomware — which is exactly why attackers go after them first. On 5 September 2024 Veeam released fixes for a critical vulnerability in Veeam Backup & Replication that allowed remote code execution through unsafe data deserialization. Security researchers later reported ransomware groups using it.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2024-40711 | Critical, CVSS 9.8 (deserialization, remote code execution) | Backup & Replication 12.1.2.172 and earlier version 12 builds | 12.2 (build 12.2.0.334) and later |
If attackers can delete your backups, you do not have backups — you have hope.
Sources: Veeam KB4649, CERT-EU 2024-092, NVD CVE-2024-40711.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
