Loading vulnerability…
Authenticated Remote Code Execution in Veeam Backup & Replication Backup Server
CVE-2026-21666 is a CRLF injection vulnerability in the Backup Server component of Veeam Backup & Replication that allows an authenticated, low-privileged domain user to execute arbitrary code remotely. User-supplied configuration parameters for connected Linux-based Backup Proxies or Hardened Repositories are incorporated into dynamically generated service execution configurations or environment settings without adequate neutralization of carriage return and line feed sequences. Crafted input can escape an intended configuration directive and introduce additional directives that execute attacker-controlled commands with the affected service's privileges. The vulnerability affects version 12.3.2.4165 and earlier version 12 builds and is fixed in version 12.3.2.4465. It has a CVSS v3.1 score of 9.9.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary remote code execution on the Veeam Backup Server by a low-privileged domain user. Execution occurs with the privileges of the affected service, potentially compromising the confidentiality, integrity, and availability of backup infrastructure and data accessible to that service. The exact execution account and its privileges are not established.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by strictly limiting which authenticated domain users can access or interact with Backup Server management functionality, especially workflows that configure connected Linux-based Backup Proxies or Hardened Repositories. Restrict network and administrative access to Backup Server interfaces, review role assignments and domain trust exposure, and monitor for suspicious configuration changes or unexpected service execution behavior. These measures are temporary risk-reduction steps and do not replace vendor patching.
Patch, then assume compromise.
Upgrade affected Veeam Backup & Replication version 12 installations to build 12.3.2.4465 or a later supported release containing the fix. Installations running builds 12.3.2.3617 or 12.3.2.4165 can use the dedicated patch; installations running version 12.3.1 or earlier require the full installation ISO to upgrade to build 12.3.2.4465. Verify the installed build through the console's Help > About menu.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.