CVE-2024-40711: listed in the CISA KEV catalog
CVE-2024-40711 · CVSS 9.8 CRITICAL · EPSS 90% · KEV 2024-10-17 · patch available
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
Is CVE-2024-40711 exploited?
- Listed in the CISA KEV catalog on 2024-10-17.
- Federal remediation due 2024-11-07.
- Past that date by 713 days.
- Used in ransomware campaigns.
- EPSS puts exploitation in the next 30 days at 90%.
- Public exploit code: none found in monitored sources.
- Public detection rules exist.
Which products and versions are affected?
- Veeam · Backup and Recovery · 12.1.2
- veeam · veeam backup & replication · >= 12.0.0.1420, < 12.2.0.334
Is there a patch?
- veeam backup & replication 12.2.0.334
What PlainSec published about CVE-2024-40711
Primary sources
KEV and EPSS are re-checked daily. Record last updated 2026-10-20.