CVE-2024-39718

HIGH
Published Sep 7, 2024 Modified May 8, 2025

Description

An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account.

Is your site exposed to CVE-2024-39718?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.1
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected Products

Vendor Product
veeam veeam_backup_\&_replication

References

Advisories & Patches

https://www.veeam.com/kb4649

Frequently Asked Questions

What is CVE-2024-39718? +
An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. It has a CVSS v3.1 base score of 8.1 (HIGH).
How severe is CVE-2024-39718? +
CVE-2024-39718 has a CVSS v3.1 score of 8.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.
What products are affected by CVE-2024-39718? +
CVE-2024-39718 affects products from veeam, specifically: veeam_backup_\&_replication. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-39718? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-48983 9.9

A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the …
CVE-2024-29212 9.9

Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent …
CVE-2024-40711 9.8

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
CVE-2024-29849 9.8

Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
CVE-2024-29855 9.0

Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator
CVE-2025-23121 8.8

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-39718 — free, no signup required.