Threat actors deploying Akira and Fog ransomware have begun actively exploiting a critical remote code execution vulnerability, tracked as CVE-2026-40711 (CVSS 9.8), affecting Veeam Backup & Replication (VBR) versions 12.1.2.172 and earlier. The flaw stems from untrusted data deserialization within the Veeam backup infrastructure service listening on TCP port 9401. Without prior authentication, an adversary with network reachability can transmit crafted serialized .NET objects, triggering arbitrary method invocation in the context of the high-privileged local system account (NT AUTHORITY\SYSTEM).

Telemetry documented by Sophos X-Ops links attacks to threat cluster STAC 5881, which leverages compromised VPN gateways lacking multi-factor authentication for initial ingress before pivoting internally to exploit VBR instances. Once code execution is established, adversaries execute PowerShell stagers, register rogue local administrator accounts, and terminate backup jobs to thwart recovery. Attackers then deploy Fog or Akira payloads across hypervisors and storage pools. Veeam addressed the flaw in version 12.2.0.334; administrators are urged to apply updates and restrict VBR management ports from untrusted segments.

Why it matters:

• Subverting recovery infrastructure neutralizes cyber resilience: Weaponizing deserialization against central backup controllers allows attackers to dismantle disaster recovery pipelines and encrypt virtualization fabrics from within the trusted zone, eliminating the victim’s out-of-band restore capabilities.
• Enforce microsegmentation and mandatory VPN credential hardening: Defenders must immediately isolate backup management ports from general internal subnets, upgrade VBR to version 12.2.0.334 or later, and enforce hardware-backed MFA across all perimeter VPN endpoints to break the initial access chain.