Vulnerability Intelligence

🛡 CVE-2024-40711

⚠ KEV remediation overdue

CISA required federal remediation by 2024-11-07. This exploited vulnerability is past its Binding Operational Directive 22-01 due date — prioritize patch/mitigation and hunt for exploitation.

📄 Description

Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.

🏹 Attributed exploitation

Malware / ransomware (KEV): Akira, Fog (Veeam Backup)

Threat actors (KEV): Akira, Fog

🔗 External references & OSINT

🔄 Internal pivots & actions

🗃 Data Management

🧩 Advanced Capabilities