New Veeam vulnerability exposes backup servers to RCE attacks

Veeam released security updates to fix CVE-2026-44963, a critical RCE in Veeam Backup & Replication 12.x that permits an authenticated low-privilege domain user to run code on domain-joined backup servers; the flaw is patched in 12.3.2.4854 and is not present in 13.x. Organizations are urged to apply updates promptly because backup servers are high-value targets for ransomware operations that have historically weaponized Veeam vulnerabilities, even though the advisory reports no active exploitation yet.