Upgrading as we speak and reading over the What’s New documents.  Looking forward to the AI features in VONE to test them out.

Hi ​@SSimpson , would you mind to give us additional details on Microsoft Entra ID Enhancements?

https://helpcenter.veeam.com/docs/backup/entraid/overview.html?ver=120

Veeam Backup for Microsoft Entra ID is a solution developed for protection and disaster recovery tasks for Microsoft Entra ID. With Veeam Backup for Microsoft Entra ID, you can perform the following operations:

• Create backups of Microsoft Entra ID tenants and store them in PostgreSQL databases.
• Create backups of Microsoft Entra ID audit and sign-in logs and store them in backup repositories.
• Restore users, groups, administrative units, roles, applications and service principals from Microsoft Entra ID tenant backups to the Microsoft Entra ID environment.
• Restore properties of users, groups, administrative units, roles, applications and service principals from Microsoft Entra ID tenant backups to the Microsoft Entra ID environment.
• Restore audit and sign-in logs from Microsoft Entra ID log backups to the Microsoft Entra ID environment.

​@SSimpson Thank you very much !!! 

hey Andre

some people in other forums are asking what happened with the 

CVE-2024-42448

RESERVED

moved from Published to reserved 

Cheers

EM

Hi ​@BigEM , here is the explanation for your question, you have to pay attetion to the 42449as well.

https://www.veeam.com/kb4679

Veeam Service Provider Console Vulnerabilities
(CVE-2024-42448 | CVE-2024-42449)

Get weekly article updates

SUBSCRIBE

By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.

Veeam Software Security Commitment

Veeam is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits. When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information. This approach ensures that all potentially affected customers can quickly implement the necessary measures to safeguard their systems. It’s important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software. This reality underscores the critical importance of ensuring that all customers use the latest versions of our software and install all updates and patches without delay.

Article Applicability

This article documents a vulnerability discovered in Veeam Service Provider Console.

This vulnerability does not affect other Veeam products (e.g., Veeam Backup & Replication, Veeam Agent for Microsoft Windows, Veeam ONE).

Issue Details

All vulnerabilities disclosed in this section affect Veeam Service Provider Console 8.1.0.21377 and all earlier versions 8 and 7 builds.

Note: Private fixes for the Veeam Service Provider Console increase the build number. Therefore, if a private fix has been applied, the deployed build number may exceed the GA build number mentioned above. In such instances, any deployed build number lower than the build reference in the Solution section should be considered affected.
Unsupported product versions are not tested, but are likely affected and should be considered vulnerable.

CVE-2024-42448

From the VSPC management agent machine, under the condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.

Severity: Critical
CVSS v3.1 Score: 9.9
Source: Discovered during internal testing.

CVE-2024-42449

From the VSPC management agent machine, under the condition that the management agent is authorized on the server, it is possible to leak an NTLM hash of the VSPC server service account and delete files on the VSPC server machine.

Severity: High
CVSS v3.1 Score: 7.1
Source: Discovered during internal testing.

Solution

The vulnerability documented in this article was fixed starting in the following build of Veeam Service Provider Console:

• Veeam Service Provider Console 8.1.0.21999

Critical Update

We encourage service providers using supported versions of Veeam Service Provider Console (versions 7 & to update to the latest cumulative patch. Service Providers using unsupported versions are strongly encouraged to upgrade to the latest version of Veeam Service Provider Console.

No Mitigations Available

No mitigation method is available for these vulnerabilities. The only remedy is to upgrade to the latest version of Veeam Service Provider Console.