Veeam Backup & Replication Critical RCE CVE-2026-44963 (CVSS 9.4)

Veeam patched CVE-2026-44963 (CVSS 9.4), a critical flaw in Backup & Replication that allows any authenticated domain user to execute remote code on the Backup Server. Backup servers are high-value targets — they hold credentials, encryption keys, and copies of every protected workload; compromise often leads directly to ransomware deployment. No confirmed active exploitation at time of publication, but Veeam vulnerabilities attract ransomware operators quickly after disclosure. Apply Veeam’s security patches immediately and verify that backup server network access is restricted to management networks with strong authentication enforced.