Veeam Backup & Replication EUVD-2026-35868

Patch available per vendor advisory - apply the fix documented in Veeam KB4869 (https://www.veeam.com/kb4869); the input data does not enumerate the exact patched build number, so the KB article should be consulted directly to confirm the target version for your installed release branch. As compensating controls until patching is complete, isolate the Backup Server from general user network segments by restricting inbound access on Veeam service ports (default TCP 9392, 9401, 9419, and dynamic .NET Remoting ports) to a tightly scoped management jump host - this materially reduces the population of 'authenticated domain users' who can reach the vulnerable surface, at the cost of breaking any direct console connections from operator workstations. Additionally, remove the Backup Server from the production AD domain or place it in a tier-0 management forest with its own trust boundary, which eliminates the 'any domain user' precondition entirely but requires reworking job scheduling, repository ACLs, and operator authentication workflows. Monitor for anomalous child processes spawned by Veeam.Backup.Service.exe as a detection layer while remediation is in progress.