Technical intelligence and weaponization dossier for CVE-2023-27532. Documented exploitation across 0 active malware families totaling 0 analyzed telemetry samples.
| Vulnerability ID | CVE-2023-27532 |
|---|---|
| Common Name / Bulletin | Veeam Backup & Replication Unauthorized Credential Disclosure & RCE (KB4424) |
| CWE Classification | CWE-287: Improper Authentication in Veeam.Backup.Service.exe |
| Affected Software & Versions | Veeam Backup & Replication versions 11a and 12 |
| Technical Root Cause | Vulnerability in Veeam.Backup.Service.exe listening on TCP port 9401 allowing unauthenticated remote requests to retrieve encrypted backup infrastructure credentials. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 0 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2023-27532 in enterprise networks:
Network traffic to TCP port 9401 with RPC calls invoking GetCredentials() or SaveCredentials(); suspicious access to backup repository configurations.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Active Incident Response Playbook →