This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Veeam Backup & Replication fixes 8 vulnerabilities

Veeam Backup & Replication fixes 8 vulnerabilities, 5 of them critical, in versions 12.3.2.4465 and 13.0.1.2067. The most severe ones are described below; the others can be found at [1][2].

Veeam Backup & Replication - RCE (CVE-2026-21666, CVE-2026-21667)
CVSS 9.9 (Critical)

An authenticated remote attacker can execute code on the backup server [1].

The vulnerability is present in product:

  • Veeam Backup & Replication; <12.3.2.4165

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 12. 3. 2026.

Veeam Backup & Replication - RCE (CVE-2026-21708)
CVSS 9.9 (Critical)

An authenticated remote attacker in the Backup Viewer role can execute code in the context of the postgres user [1][2].

The vulnerability is present in product:

  • Veeam Backup & Replication; <12.3.2.4165; >=13.0, <13.0.1.2067;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 12. 3. 2026.

Veeam Backup & Replication - RCE (CVE-2026-21669 )
CVSS 9.9 (Critical)

An authenticated remote attacker can execute code on the backup server [2].

The vulnerability is present in product:

  • Veeam Backup & Replication; <13.0.1.2067;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 12. 3. 2026.

Veeam Backup & Replication - RCE (CVE-2026-21671)
CVSS 9.1 (Critical)

An authenticated remote attacker in the Backup Administrator role can execute code in highly available infrastructure deployments [2].

The vulnerability is present in product:

  • Veeam Backup & Replication; <13.0.1.2067;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 12. 3. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 16. 3. 2026.

CESNET, z.s.p.o. Logo