This vulnerability (CVE-2026-44963) in Veeam Backup and Replication involves deserialization of untrusted data (CWE-502), which can be exploited by an authenticated domain user to achieve remote code execution on the Backup Server. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack traceability, and high impacts on confidentiality, integrity, availability, and security requirements. The vulnerability is published and assigned by HackerOne but currently lacks an official remediation or patch from the vendor. It is not a cloud service, so remediation responsibility lies with the customer once a fix is available.

Successful exploitation allows an authenticated domain user to execute arbitrary code remotely on the Backup Server, potentially compromising the confidentiality, integrity, and availability of backup data and systems. This could lead to full system compromise of the backup infrastructure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict domain user privileges and monitor for suspicious activity related to backup server access. Follow vendor updates closely for any forthcoming patches or official mitigations.