Loading vulnerability…
Authenticated Remote Code Execution in Veeam Backup & Replication Backup Server
CVE-2026-21669 is a critical remote code execution vulnerability in the Backup Server component of Veeam Backup & Replication 13.x before version 13.0.1.2067. An authenticated, low-privileged domain user can execute code remotely on a vulnerable backup server through a low-complexity attack. The vulnerability has a reported CVSS score of 9.9. The underlying weakness, vulnerable function, and execution security context are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises code execution integrity on the Backup Server. Depending on the execution privileges obtained, an attacker could access or alter backup-related data, disrupt backup and recovery operations, or use the compromised server for further attacks. The execution account and precise scope of accessible resources are not specified.
If you can’t patch tonight, do this now.
If immediate upgrading is not possible, reduce exposure of the Backup Server by tightly restricting access to trusted administrative networks and limiting which domain users can authenticate to systems that can reach the vulnerable service. Review and minimize domain user access paths to backup infrastructure, monitor for suspicious activity involving low-privileged domain accounts interacting with the backup environment, and prioritize isolation of backup management systems until the vendor fix can be applied. No specific vendor workaround beyond upgrading is currently available in the provided information.
Patch, then assume compromise.
Upgrade affected Veeam Backup & Replication 13.x installations to version 13.0.1.2067 or a later supported release containing the fix. Version 12.3.2.4465 addresses other vulnerabilities and is not identified as the fix for CVE-2026-21669.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.