Loading vulnerability…
Authenticated Remote Code Execution in Veeam Backup & Replication Backup Server
CVE-2026-21667 is a critical remote code execution vulnerability in the Backup Server component of Veeam Backup & Replication. It affects version 12.3.2.4165 and earlier version 12 builds. An authenticated, low-privileged domain user can exploit the vulnerability in a low-complexity attack to execute arbitrary code remotely on the Backup Server. The vulnerability has a CVSS v3.1 score of 9.9 and was fixed in build 12.3.2.4465. The underlying technical weakness and vulnerable function have not been specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises code execution integrity on the Backup Server and could lead to full server compromise. Compromise of backup infrastructure could expose protected data, enable lateral movement, or disrupt backup and recovery operations. The execution account and resulting operating-system privileges are not specified.
If you can’t patch tonight, do this now.
Apply vendor-issued security updates immediately. Until patching is completed, reduce exposure of the Backup Server to untrusted or broadly accessible domain accounts, restrict administrative and service access paths, and closely monitor authentication and execution activity involving the backup environment. No specific vendor workaround beyond upgrading is currently available from the provided information.
Patch, then assume compromise.
Upgrade affected Veeam Backup & Replication version 12 installations to build 12.3.2.4465 or a later supported release containing the fix. Installations running builds 12.3.2.3617 or 12.3.2.4165 can use the dedicated patch; installations running version 12.3.1 or earlier require the full installation ISO to upgrade to build 12.3.2.4465. Verify the installed build through Main Menu > Help > About in the console.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.