Veeam Fixes Multiple Critical Backup & Replication RCE Vulnerabilities
Patch & Detection Intelligence · 9 sources · Updated 3mo ago · First seen Mar 13, 2026
Veeam released security updates for Backup & Replication to address multiple high-severity flaws, including several remote code execution issues affecting version 12.3.2.4165 and all earlier version 12 builds. The disclosed vulnerabilities include CVE-2026-21666, CVE-2026-21667, CVE-2026-21668, CVE-2026-21672, and CVE-2026-21708, with several carrying CVSS 9.9 ratings. According to the advisories, successful exploitation could allow authenticated domain users to execute code on the backup server, manipulate arbitrary files on a backup repository, or achieve local privilege escalation on Windows-based servers.
Veeam said the issues were fixed in Backup & Replication version 12.3.2.4465, while CVE-2026-21672 and CVE-2026-21708 were also remediated in version 13.0.1.2067, alongside additional critical flaws CVE-2026-21669 and CVE-2026-21671. The company warned that public patch disclosure increases the likelihood of patch reverse engineering and follow-on attacks against unpatched systems, making rapid remediation a priority for organizations running exposed or domain-connected Veeam infrastructure.
