CVE-2024-40710
Published: 07 September 2024
Summary
CVE-2024-40710 is a high-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Veeam Veeam Backup \& Replication. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 11.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-40710 is a set of related high-severity vulnerabilities affecting Veeam Backup & Replication. The most prominent issue permits remote code execution as the service account along with extraction of sensitive data such as saved credentials and passwords. The flaws are tracked under CWE-522 and carry a CVSS 3.1 score of 8.8.
Exploitation requires an attacker who has already been granted a low-privileged role within the product. With that access an adversary can achieve code execution on the server and obtain stored credentials, enabling further lateral movement or privilege escalation inside the backup environment.
The vendor advisory at https://www.veeam.com/kb4649 addresses mitigation steps and available patches for the affected Veeam Backup & Replication installations.
EPSS for the CVE rose from a low baseline to a peak of 0.0916 on 2026-02-03 before receding to the current value of 0.0420, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38577
Vulnerability details
A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and passwords). Exploiting these vulnerabilities requires a user who has been assigned a low-privileged role within…
more
Veeam Backup & Replication.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Training instructs users on protecting credentials from disclosure or unauthorized access.
Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.
Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.
Rules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials.
Terminating or revoking credentials stops use of insufficiently protected or lingering credentials post-termination.
Requiring confidentiality/integrity protection for stored credentials directly mitigates insufficiently protected credentials on disk or in configuration stores.
Credentials or keys delivered out-of-band are not exposed to interception or inadequate protection on the main transport.