TI-2024-27113 Aliases CVE-2024-40718 GHSA-wvqf-qcwj-mjxr

Server-side request forgery in Veeam Nutanix AHV

MEDIUM 40CWE-918Published 2024-09-07 · Updated 2024-09-09

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00456 39th percentileScored 2026-11-07

Fix Fixed Nutanix AHV (Veeam): 12.6.0Nutanix KVM (Veeam): 12.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Veeam	Nutanix AHV	12.6.0 to before 12.6.0	12.6.0	Patch available	CNA
Veeam	Nutanix KVM	12.5.0 to before 12.5.0	12.5.0	Patch available	CNA

Nutanix AHV VendorVeeam Affected 12.6.0 to before 12.6.0 Fixed in 12.6.0 Patch available CNA
Nutanix KVM VendorVeeam Affected 12.5.0 to before 12.5.0 Fixed in 12.5.0 Patch available CNA

CPE names CISA-ADP · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:veeam:backup_for_nutanix_ahv::::::::	—	—	Veeam
cpe:2.3:a:veeam:backup_for_oracle_linux_virtualization_manager_and_red_hat_virtualization::::::::	—	—	Veeam

cpe:2.3:a:veeam:backup_for_nutanix_ahv:*:*:*:*:*:*:*:* Versions — — ·Veeam
cpe:2.3:a:veeam:backup_for_oracle_linux_virtualization_manager_and_red_hat_virtualization:*:*:*:*:*:*:*:* Versions — — ·Veeam

Remediation

Fix · CNA Nutanix AHV (Veeam) Fixed in 12.6.0
Fix · CNA Nutanix KVM (Veeam) Fixed in 12.5.0

Timeline

2026-10-02 Threatist record created from CVE-2024-40718
2026-10-03 Alias added: GHSA-wvqf-qcwj-mjxr

References

Other 1

https://www.veeam.com/kb4649

TI-2024-27107 Deserialization of untrusted data in Veeam Backup and Recovery KEVCVSS 3.1CRITICAL 9.8
TI-2022-09844 Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). KEVCVSS 3.1CRITICAL 9.8
TI-2022-09843 Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and… KEVCVSS 3.1HIGH 8.8
TI-2023-12256 Missing authentication in Veeam Backup & Replication KEVCVSS 3.1HIGH 7.5
TI-2020-08796 Deserialization of untrusted data in Veeam One Agent CVSS 3.1CRITICAL 9.8
TI-2024-19623 Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. CVSS 3.0CRITICAL 9.8

See all 119 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences