Veeam has issued patches to address a high-severity RCE vulnerability in its Backup Enterprise Manager, tracked as CVE-2024-40715.
The flaw can be exploited through a man-in-the-middle (MiTM) attack, allowing attackers to bypass authentication and gain unauthorized access to sensitive data and potentially allow further malicious activities.
Veeam has released a hotfix for Backup Enterprise Manager version 12.2.0.334, as well as updated installation images for Veeam Backup & Replication and Veeam Data Platform, which include the necessary patch.
For users already running version 12.2.0.334, Veeam strongly recommends applying the hotfix directly. Alternatively, users can upgrade to the latest fixed release via the most recent Veeam Backup & Replication ISOs. Veeam has clarified that the installation of this hotfix will not modify the build number, though a reboot may be necessary to complete the update.
While Veeam has not reported any instances of active exploitation of CVE-2024-40715, users are strongly recommended to update their installs as soon as possible, given that threat actors are actively abusing other Veeam vulnerabilities for initial access.
Last week, cybersecurity firm Sophos detailed the ongoing exploitation of a critical vulnerability in Veeam backup servers (CVE-2024-40711) to deploy the new Frag ransomware.