CVE-2024-40711

KEV RANSOMWARECRITICAL 9.8EPSS 90.4%

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

CVSS v3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.0: 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 90.37% chance of exploitation in the next 30 days, 100th percentile
CISA KEV: added 2024-10-17, used in ransomware campaigns
Nuclei: critical · CWE-502
Published: 2024-09-07
Updated: 2025-10-21

Proof-of-concept exploits (3)

https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cv…
realstatus/CVE-2024-40711-Exp42★ · 2024-10-17
watchtowrlabs/CVE-2024-4071155★ · 2024-09-15

Nuclei templates (1)

projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-40711.yaml

References

Related