Full Report
Data protection company Veeam Software has patched multiple flaws in its Backup & Replication solution, including four critical remote code execution (RCE) vulnerabilities. [...]
Analysis Summary
# Vulnerability: Multiple RCE and Privilege Escalation Flaws in Veeam Backup & Replication
## CVE Details
- **CVE ID:** CVE-2026-21666, CVE-2026-21667, CVE-2026-21669, CVE-2026-21708 (Critical RCEs)
- **CVSS Score:** 9.0 - 10.0 (Estimated Critical Severity)
- **CWE:** Not specified (Likely Improper Input Validation / Unsafe Deserialization)
## Affected Systems
- **Products:** Veeam Backup & Replication (VBR)
- **Versions:** All versions prior to 12.3.2.4465 and 13.0.1.2067.
- **Configurations:**
- CVE-2026-21666/21667/21669: Applicable to environments with low-privileged domain users.
- CVE-2026-21708: Specific to configurations where "Backup Viewer" roles are assigned.
## Vulnerability Description
Veeam addressed four critical Remote Code Execution (RCE) flaws. Three of these (CVE-2026-21666, CVE-2026-21667, and CVE-2026-21669) allow a standard domain user with low privileges to execute arbitrary code on the backup server. The fourth (CVE-2026-21708) allows a user with the "Backup Viewer" role to execute code with the permissions of the Postgres database user.
Additionally, high-severity flaws were patched that allow for Windows privilege escalation, extraction of saved SSH credentials, and arbitrary file manipulation on Backup Repositories.
## Exploitation
- **Status:** PoC available (under development/implied by vendor warning); No confirmed "in-the-wild" exploitation for *these specific labels* yet, but historically VBR flaws are targeted quickly by ransomware groups (e.g., FIN7, Akira, Fog).
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full data access and credential theft)
- **Integrity:** High (Ability to modify/manipulate backup files and system state)
- **Availability:** High (Potential for complete deletion of backups and disruption of recovery services)
## Remediation
### Patches
The following protected versions have been released:
- **Veeam Backup & Replication v12:** Update to version **12.3.2.4465**
- **Veeam Backup & Replication v13:** Update to version **13.0.1.2067**
### Workarounds
No specific configuration workarounds were provided. The vendor strongly recommends an immediate upgrade due to the high risk of reverse-engineering by threat actors.
## Detection
- **Indicators of Compromise:** Monitor for unusual network traffic originating from the VBR server or unexpected processes running under the `postgres` user or system service accounts.
- **Detection methods and tools:** Review Veeam logs for unauthorized logins from low-privileged domain accounts and audit changes to the Backup Repository filesystem.
## References
- **Vendor Advisories:**
- hxxps[://]www[.]veeam[.]com/kb4696
- hxxps[://]www[.]veeam[.]com/kb4738
- hxxps[://]www[.]veeam[.]com/kb4830
- **Vulnerability Sources:**
- hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-21666
- hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-21667
- hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-21669
- hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-21708