Loading vulnerability…
Restriction Bypass and Arbitrary File Manipulation in Veeam Backup & Replication
CVE-2026-21668 is a restriction bypass vulnerability in the Backup Repository component of Veeam Backup & Replication. An authenticated domain user can bypass security restrictions and manipulate arbitrary files on a Backup Repository. The vulnerability affects version 12.3.2.4165 and earlier version 12 builds and is fixed in version 12.3.2.4465. It has a CVSS v3.1 score of 8.8. The vulnerable function and underlying implementation defect are not disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized manipulation of arbitrary repository files, compromising backup integrity and potentially undermining the reliability of data restoration. Remote code execution, credential disclosure, and privilege escalation are not established impacts of this specific vulnerability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting Backup Repository access to only strictly necessary trusted accounts, minimizing domain user access to backup infrastructure, and enforcing strong segregation between general domain users and backup administration or repository systems. Monitor for unauthorized file changes within backup repositories and restrict interactive or administrative access paths to backup infrastructure until the fixed release can be deployed. No specific vendor workaround beyond applying the update is currently available from the provided information.
Patch, then assume compromise.
Upgrade affected Veeam Backup & Replication version 12 deployments to build 12.3.2.4465 or a later supported release containing the fix. Deployments running builds 12.3.2.3617 or 12.3.2.4165 can use the dedicated patch; deployments running version 12.3.1 or earlier require the full installation ISO to upgrade to build 12.3.2.4465.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.