CVE-2024-42455

A flaw in Veeam Backup & Replication lets a low-privilege user send specially crafted data that tricks the service into deleting files it shouldn't. This happens because the service doesn't properly check what it's deserializing before executing it.

The vulnerability exists in the remoting services deserialization mechanism, where an insufficient blacklist allows a low-privileged attacker to send malicious serialized objects (temporary file collections) that execute with service account privileges. This enables arbitrary file deletion on the system. The attack requires network access to the remoting service endpoint but no authentication bypass is needed due to the low privilege requirement.