{"id":"CVE-2024-40711","aliases":["EUVD-2024-38578","GHSA-c76v-gjqc-j462"],"status":"published","title":"A deserialization of untrusted data vulnerability with a malicious payload can allow an...","description":"A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.90369,"percentile":0.99803,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-502"],"published":"2024-09-07T16:11:22Z","modified":"2026-06-17T07:46:23Z","kev":{"date_added":"2024-10-17","due_date":"2024-11-07","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2024-10-17"},{"source":"kev","since":"2024-10-17"}],"exploits":[{"source":"pocgithub","id":"watchtowrlabs/CVE-2024-40711","title":"watchtowrlabs/CVE-2024-40711","date":"2024-09-15","url":"https://github.com/watchtowrlabs/CVE-2024-40711"},{"source":"pocgithub","id":"realstatus/CVE-2024-40711-Exp","title":"realstatus/CVE-2024-40711-Exp","date":"2024-10-16","url":"https://github.com/realstatus/CVE-2024-40711-Exp"},{"source":"nuclei","id":"CVE-2024-40711","title":"Veeam Backup \u0026 Replication - Unauthenticated","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-40711.yaml"}],"products":[{"vendor":"veeam","product":"backup \u0026 replication"},{"vendor":"veeam","product":"backup and  recovery"},{"vendor":"veeam","product":"backup_\\\u0026_replication"},{"vendor":"veeam","product":"veeam_backup_\\\u0026_replication"}],"references":[{"url":"https://www.veeam.com/kb4649","tags":["Vendor Advisory"]},{"url":"https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40711","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40711"},{"url":"https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2"},{"url":"https://github.com/advisories/GHSA-c76v-gjqc-j462"}],"sources":{"cve":[{"id":"CVE-2024-40711","description":"A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).","status":"published","published":"2024-09-07T16:11:22.213Z","modified":"2025-10-21T22:55:45.81Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:34:06.811965Z"}],"euvd":[{"id":"EUVD-2024-38578","description":"A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).","status":"published","published":"2024-09-07T16:11:22Z","modified":"2025-10-21T22:55:45Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-10-17","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-c76v-gjqc-j462","title":"A deserialization of untrusted data vulnerability with a malicious payload can allow an...","description":"A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).","status":"published","published":"2024-09-07T18:30:24Z","modified":"2025-10-22T00:33:06Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:04:07.67458Z"}],"kev":[{"id":"CVE-2024-40711","title":"Veeam Backup and Replication Deserialization Vulnerability","description":"Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.","cwes":["CWE-502"],"kev":{"date_added":"2024-10-17","due_date":"2024-11-07","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2024-40711","description":"A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).","status":"published","published":"2024-09-07T17:15:13.26Z","modified":"2026-06-17T07:46:23.383Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:10:25.561537Z"}]}}