Veeam has released critical security updates for its Backup & Replication software , fixing seven serious vulnerabilities that could lead to remote code execution (RCE). The vulnerabilities, with CVSS scores of up to 9.9 , pose an immediate threat to organizations using the popular backup software. The severity of the vulnerabilities makes it imperative to update systems immediately , as attackers could gain complete control over backup infrastructures.
See also: Veeam Backup: Critical RCE vulnerabilities allow remote code execution
The most critical vulnerabilities are CVE-2026-21666 and CVE-2026-21667 , which allow authenticated domain users to execute remote code on the Backup Server . CVE-2026-21669 exhibits similar behavior, while CVE-2026-21708 allows users with Backup Viewer privileges to execute code as the postgres user . These vulnerabilities are particularly dangerous because they exploit existing user privileges, making it difficult to detect unauthorized activity.
CVE -2026-21668, with a score of 8.8, allows authenticated domain users to bypass restrictions and manipulate arbitrary files in the Backup Repository. Meanwhile, CVE-2026-21672 creates local privilege escalation capabilities for Windows. This vulnerability is particularly concerning as it can be used as a stepping stone for further privilege escalation across the entire company network.
CVE -2026-21671 with a rating of 9.1 specifically targets HA deployments, allowing users with the Backup Administrator to execute remote code.
See also: Veeam fixes vulnerabilities in Backup & Replication (VBR)
These vulnerabilities affect versions 12 through 12.3.2.4165. They have been addressed in version 12.3.2.4465. CVE-2026-21672 and CVE-2026-21708 have also been fixed in Backup & Replication 13.0.1.2067, along with CVE-2026-21669 and CVE-2026-21671.
Veeam emphasizes in its announcement: “ It is important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse engineer the patch to exploit unpatched installations of Veeam software . ” This warning underscores the importance of applying patches promptly , as malicious actors often analyze patches to create exploits for unpatched systems.
See also: Claude Code: Vulnerabilities allow RCE attacks and API key theft
Defense strategies and advanced security practices
Beyond immediately applying patches, organizations should adopt a defense-in-depth strategy to protect their backup infrastructure. This includes implementing a 3-2-1 backup (3 copies, 2 different media, 1 off-site), using immutable backups that cannot be modified or deleted, and implementing air-gapped solutions for critical data. In addition, regularly verifying the integrity of backups and conducting recovery tests are essential to ensuring the effectiveness of the backup strategy.
