CVE-2024-40717

A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share and are executed with elevated privileges by default. The user can update a job and schedule it to run almost immediately, allowing arbitrary code execution on the server.

• CWE-306

• https://www.veeam.com/kb4693Vendor Advisory

Published

Dec 4, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-40710A series of related high-severity vulnerabilities, the most …8.8
• CVE-2024-40711A deserialization of untrusted data vulnerability with a mal…9.8
• CVE-2024-40712A path traversal vulnerability allows an attacker with a low…7.8
• CVE-2024-40713A vulnerability that allows a user who has been assigned a l…7.8
• CVE-2024-40714An improper certificate validation vulnerability in TLS cert…8.3
• CVE-2024-40715A vulnerability in Veeam Backup & Replication Enterprise Man…7.7
• CVE-2024-40718A server side request forgery vulnerability allows a low-pri…8.8
• CVE-2024-40719The encryption strength of the authorization keys in CHANGIN…6.5
• CVE-2024-4072A vulnerability was found in Kashipara Online Furniture Shop…5.4
• CVE-2024-40720The specific API in TCBServiSign Windows Version from CHANGI…8.8
• CVE-2024-40721The specific API in TCBServiSign Windows Version from CHANGI…8.8
• CVE-2024-40722The specific API in TCBServiSign Windows Version from CHANGI…4.3