{"id":"CVE-2024-40711","aliases":[],"url":"https://o3.security/vulnerability/CVE-2024-40711","summary":"A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).","details":"A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).","published":"2024-09-07T16:11:22.213Z","modified":"2025-10-21T22:55:45.810Z","cvss":null,"epss":{"score":0.90369,"percentile":0.99793,"asOf":"2026-09-17"},"cisaKev":{"dateAdded":"2024-10-17","dueDate":"2024-11-07","knownRansomwareCampaignUse":true},"exploitsKnown":6,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://www.veeam.com/kb4649"},{"type":"WEB","url":"https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40711"}],"provenance":{"sources":["OSV.dev","NVD","CISA KEV","FIRST.org (EPSS)"],"lastVerified":"2025-10-21T22:55:45.810Z"}}