CVE-2026-44963

An authenticated domain user can execute arbitrary code remotely on the Backup Server, compromising the entire backup infrastructure. This is critical because backups are often the last line of defense against data loss and ransomware attacks.

CWE-502 (Deserialization of Untrusted Data) enables RCE when an authenticated domain user sends malicious serialized objects to the Backup Server. Attack vector requires prior authentication and network access to the service; successful exploitation grants arbitrary code execution with server privileges, potentially affecting data confidentiality, integrity, and availability of all backed-up systems.