Veeam disclosed another remote-code-execution vulnerability in Backup & Replication this month — the latest in a run of serious flaws in backup platforms. It matters more than a typical CVE because of where the box sits: the backup server has credentials to your hypervisors, your storage and often your domain. Compromise it and an attacker doesn’t just encrypt the live environment, they delete the thing you were relying on to recover.
That is exactly the playbook modern ransomware uses — disable or destroy backups first, detonate second. A backup server running months behind on patches, joined to the same domain as everything it protects, is the soft target that turns a bad day into an existential one.
Patch backup infrastructure on the same cadence as your most exposed servers, isolate it from the production domain, and keep at least one immutable, offline or object-locked copy that a compromised backup console can’t reach. The control that survives a breach is the one the attacker couldn’t log into.