Digest · Wednesday

Security digest: September 4, 2024

1 editorial brief.

All digests · RSS · Markdown

Take stock

Act now: Veeam Backup & Replication RCE (CVE-2024-40711). Every organization running Veeam Backup & Replication 12.1.2.172 or an earlier version 12 build, or an unsupported older version.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

Sep 4, 2024 · Vulnerability · CVE-2024-40711

Veeam Backup & Replication RCE (CVE-2024-40711)

Ransomware crews have used this to take over backup servers; any Veeam Backup & Replication v12 server below 12.2 is an emergency, and backup servers should never be reachable from user or internet networks.

Must act: Every organization running Veeam Backup & Replication 12.1.2.172 or an earlier version 12 build, or an unsupported older version.

Can relax: Organizations that do not use Veeam Backup & Replication, and those already on 12.2.0.334 or later with backup servers isolated from general networks.

Upgrade Veeam Backup & Replication to 12.2.0.334 or the latest supported release
Isolate backup servers: block the Veeam services from user subnets, VPN pools and the internet
Enforce MFA on VPNs and remote access, the initial access path seen in the ransomware cases

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.