{"id":"CVE-2024-40711","aliases":[],"url":"https://o3.security/vulnerability/CVE-2024-40711","summary":"A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).","details":"A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).","published":"2024-09-07T17:15:13.260","modified":"2026-06-17T07:46:23.383","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.90369,"percentile":0.9979,"asOf":"2026-08-22"},"cisaKev":{"dateAdded":"2024-10-17","dueDate":"2024-11-07","knownRansomwareCampaignUse":true},"exploitsKnown":6,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://www.veeam.com/kb4649"},{"type":"EXPLOIT","url":"https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40711"}],"provenance":{"sources":["OSV.dev","NVD","CISA KEV","FIRST.org (EPSS)"],"lastVerified":"2026-06-17T07:46:23.383"}}