CVE-2024-42455

A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. This exploit allows the attacker to delete any file on the system with service account privileges. The vulnerability is caused by an insufficient blacklist during the deserialization process.

• CWE-306

• https://www.veeam.com/kb4693Vendor Advisory

Published

Dec 4, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42449From the VSPC management agent machine, under condition that…7.1
• CVE-2024-4245A vulnerability, which was classified as critical, has been …8.8
• CVE-2024-42450The Versa Director uses PostgreSQL (Postgres) to store opera…10
• CVE-2024-42451A vulnerability in Veeam Backup & Replication allows low-pri…6.5
• CVE-2024-42452A vulnerability in Veeam Backup & Replication allows a low-p…8.8
• CVE-2024-42453A vulnerability Veeam Backup & Replication allows low-privil…8.1
• CVE-2024-42456A vulnerability in Veeam Backup & Replication platform allow…8.8
• CVE-2024-42457A vulnerability in Veeam Backup & Replication allows users w…6.5
• CVE-2024-42458server.c in Neat VNC (aka neatvnc) before 0.8.1 does not pro…9.8
• CVE-2024-42459In the Elliptic package 6.5.6 for Node.js, EDDSA signature m…5.3
• CVE-2024-4246A vulnerability, which was classified as critical, was found…8.8
• CVE-2024-42460In the Elliptic package 6.5.6 for Node.js, ECDSA signature m…5.3