CVE-2026-44963 (CVSS 9.4): Any Domain User Can RCE Veeam Backup & Replication 12.x — Ransomware Weaponization Expected Imminently

WatchTowr researcher Sina Kheirkhah disclosed CVE-2026-44963, a critical RCE flaw in Veeam Backup & Replication affecting all 12.x builds up to 12.3.2.4465 on domain-joined deployments; any authenticated domain user — not just an admin — can execute arbitrary code on the backup server. Veeam patched in build 12.3.2.4854 on June 9 and explicitly warned that threat actors routinely reverse-engineer patches to weaponize them rapidly, a pattern already confirmed with prior Veeam flaws CVE-2024-40711 (exploited by Akira and Fog within weeks) and CVE-2025-23121. Backup servers are the ransomware kill shot — compromise before encryption removes the victim's recovery option entirely; organizations running domain-joined Veeam must treat this as an emergency patch.

Backup servers are the ransomware kill shot — compromise before encryption removes the victim's recovery option entirely; organizations running domain-joined Veeam must treat this as an emergency patch.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.