Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
Veeam Backup RCE Flaw Lets Low-Privileged Domain Users Gain SYSTEM Access
Excerpt
A newly disclosed vulnerability, CVE-2026-44963 , allows any authenticated domain user to execute code remotely on a Veeam Backup & Replication server, resulting in a full compromise of the enterprise backup infrastructure. The flaw carries a critical severity rating and was patched in version 12.3.2.4854, released on June 5-9, 2026, with all builds up to and including 12.3.2.4465 affected. Veeam credits the discovery to Sina Kheirkhah of watchTowr and confirms that the…
Read the original report →Attack Flow7 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2024-40711 | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-48984 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-44963 | Medium | Score 57/100 | First seen |
| CVE | CVE-2025-23120 | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-48983 | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-23121 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…